Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
MIME-Version: 1.0
References: <CAG48ez1tJZTOjS_FjRZhvtDA-STFmdw8PEizPDwMGFd_ui0Nrw@mail.gmail.com>
 <20221205145005.ku75npr3dsz3fqgo@revolver>
In-Reply-To: <20221205145005.ku75npr3dsz3fqgo@revolver>
From:   Jann Horn <jannh@google.com>
Date:   Mon, 5 Dec 2022 15:53:09 +0100
Message-ID: <CAG48ez1=dLpebzSNu+8_kOfbVLySXZF44nmr+TU5m4cUjg0MBA@mail.gmail.com>
Subject: Re: brk() in v6.1-rc1 can expand file mappings, seemingly without
 taking file locks
To:     Liam Howlett <liam.howlett@oracle.com>
Cc:     Linux-MM <linux-mm@kvack.org>,
        Andrew Morton <akpm@linux-foundation.org>,
        kernel list <linux-kernel@vger.kernel.org>,
        Jason Donenfeld <Jason@zx2c4.com>, Yu Zhao <yuzhao@google.com>,
        "Matthew Wilcox (Oracle)" <willy@infradead.org>,
        SeongJae Park <sj@kernel.org>, Vlastimil Babka <vbabka@suse.cz>
Content-Type: text/plain; charset="UTF-8"
Precedence: bulk

On Mon, Dec 5, 2022 at 3:50 PM Liam Howlett <liam.howlett@oracle.com> wrote:
> * Jann Horn <jannh@google.com> [221202 13:54]:
> > As of commit ca57f02295f, brk() can expand ordinary file mappings (but
> > not file mappings with weird flags), and I think it does it with
> > insufficient locks. I think brk() probably needs some extra checks to
> > make sure it's operating on a brk-like VMA (which means it should at
> > least be anonymous, and perhaps pass the full can_vma_merge_after()
> > check so that we're not creating unnecessary special cases?).
>
>
> Thanks.  This is probably caused by commit 2e7ce7d354f2: "mm/mmap:
> change do_brk_flags() to expand existing VMA and add do_brk_munmap()"

Yeah.

> Specifically the checks around expanding the VMA.
>
> > user@vm:~/brk_stretch$ cat brk_file.c
>
> Thanks for the testcase.  I have a fix that I'm testing, but it's worth
> noting that the brk call will succeed - except a new VMA will be
> created.  Is this what you expect?

Yes, that's what I would expect.