procfs: avoid fetching build ID while holding VMA lock

Hi Andrii,

kernel test robot noticed the following build warnings:

[auto build test WARNING on bpf-next/net]
[also build test WARNING on bpf-next/master bpf/master linus/master v6.19-rc7] [cannot apply to akpm-mm/mm-everything next-20260129]
[If your patch is applied to the wrong git tree, kindly drop us a note. And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Andrii-Nakryiko/procfs-avoid-fetching-build-ID-while-holding-VMA-lock/20260130-055639
base:   https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git net
patch link:    https://lore.kernel.org/r/20260129215340.3742283-1-andrii%40kernel.org
patch subject: [PATCH v2 mm-stable] procfs: avoid fetching build ID while holding VMA lock
config: nios2-allnoconfig (https://download.01.org/0day-ci/archive/20260130/[email protected]/config)
compiler: nios2-linux-gcc (GCC) 11.5.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260130/[email protected]/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <[email protected]>
| Closes: https://lore.kernel.org/oe-kbuild-all/[email protected]/

All warnings (new ones prefixed by >>):

Quoted 1 line

Quoted 1 line

Warning: lib/buildid.c:348 This comment starts with '/**', but isn't a kernel-doc comment. Refer to Documentation/doc-guide/kernel-doc.rst

* Parse build ID of ELF file

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

Quoted 7 lines

If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <[email protected]>
| Closes: https://lore.kernel.org/oe-kbuild-all/[email protected]/

All warnings (new ones prefixed by >>):

Quoted 2 lines

Quoted 1 line

Quoted 1 line

Warning: lib/buildid.c:348 This comment starts with '/**', but isn't a kernel-doc comment. Refer to Documentation/doc-guide/kernel-doc.rst

* Parse build ID of ELF file

So AI tells me to be a proper kernel-doc comment this should have been:

* build_id_parse_file() - Parse build ID of ELF file

Andrew, should I send v3 or you can just patch it up in-place? Thanks!

Quoted 12 lines · On Fri, 30 Jan 2026 12:11:31 -0800 Andrii Nakryiko <[email protected]>…

Quoted 9 lines

If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <[email protected]>
| Closes: https://lore.kernel.org/oe-kbuild-all/[email protected]/

All warnings (new ones prefixed by >>):

Quoted 1 line

Quoted 1 line

Warning: lib/buildid.c:348 This comment starts with '/**', but isn't a kernel-doc comment. Refer to Documentation/doc-guide/kernel-doc.rst

* Parse build ID of ELF file

So AI tells me to be a proper kernel-doc comment this should have been:

Quoted 3 lines

* build_id_parse_file() - Parse build ID of ELF file

Andrew, should I send v3 or you can just patch it up in-place? Thanks!

No probs.

The preceding two functions are trying to be kerneldoc but failed. How about this?

lib/buildid.c renamed from lib/buildid.c~procfs-avoid-fetching-build-id-while-holding-vma-lock-fix +5 -5

@@ -315,8 +315,8 @@ out:
        return ret;
 }
 
-/*
- * Parse build ID of ELF file mapped to vma
+/**
+ * build_id_parse_nofault() - Parse build ID of ELF file mapped to vma
  * @vma:      vma object
  * @build_id: buffer to store build id, at least BUILD_ID_SIZE long
  * @size:     returns actual build id size in case of success

@@ -334,8 +334,8 @@ int build_id_parse_nofault(struct vm_are
        return __build_id_parse(vma->vm_file, build_id, size, false /* !may_fault */);
 }
 
-/*
- * Parse build ID of ELF file mapped to VMA
+/**
+ * build_id_parse() - Parse build ID of ELF file mapped to VMA
  * @vma:      vma object
  * @build_id: buffer to store build id, at least BUILD_ID_SIZE long
  * @size:     returns actual build id size in case of success

@@ -354,7 +354,7 @@ int build_id_parse(struct vm_area_struct
 }
 
 /**
- * Parse build ID of ELF file
+ * build_id_parse_file() - Parse build ID of ELF file
  * @file:      file object
  * @build_id: buffer to store build id, at least BUILD_ID_SIZE long
  * @size:     returns actual build id size in case of success

_

Fix PROCMAP_QUERY to fetch optional build ID only after dropping mmap_lock or per-VMA lock, whichever was used to lock VMA under question, to avoid deadlock reported by syzbot:

-> #1 (&mm->mmap_lock){++++}-{4:4}:

        __might_fault+0xed/0x170
        _copy_to_iter+0x118/0x1720
        copy_page_to_iter+0x12d/0x1e0
        filemap_read+0x720/0x10a0
        blkdev_read_iter+0x2b5/0x4e0
        vfs_read+0x7f4/0xae0
        ksys_read+0x12a/0x250
        do_syscall_64+0xcb/0xf80
        entry_SYSCALL_64_after_hwframe+0x77/0x7f

-> #0 (&sb->s_type->i_mutex_key#8){++++}-{4:4}:

        __lock_acquire+0x1509/0x26d0
        lock_acquire+0x185/0x340
        down_read+0x98/0x490
        blkdev_read_iter+0x2a7/0x4e0
        __kernel_read+0x39a/0xa90
        freader_fetch+0x1d5/0xa80
        __build_id_parse.isra.0+0xea/0x6a0
        do_procmap_query+0xd75/0x1050
        procfs_procmap_ioctl+0x7a/0xb0
        __x64_sys_ioctl+0x18e/0x210
        do_syscall_64+0xcb/0xf80
        entry_SYSCALL_64_after_hwframe+0x77/0x7f

other info that might help us debug this:

  Possible unsafe locking scenario:

        CPU0                    CPU1
        ----                    ----
   rlock(&mm->mmap_lock);
                                lock(&sb->s_type->i_mutex_key#8);
                                lock(&mm->mmap_lock);

rlock(&sb->s_type->i_mutex_key#8);

*** DEADLOCK ***

To make this safe, we need to grab file refcount while VMA is still locked, but other than that everything is pretty straightforward. Internal build_id_parse() API assumes VMA is passed, but it only needs the underlying file reference, so just add another variant build_id_parse_file() that expects file passed directly.

Fixes ed5d583a88a9 ("fs/procfs: implement efficient VMA querying API for /proc/<pid>/maps")

Reported-by [email protected]

Reviewed-by Suren Baghdasaryan <[email protected]>

Tested-by Suren Baghdasaryan <[email protected]>

Signed-off-by Andrii Nakryiko <[email protected]>

fs/proc/task_mmu.c +3 -0

 	/* unlock vma or mmap_lock, and put mm_struct before copying data to user */
 	query_vma_teardown(&lock_ctx);
 	mmput(mm);
 
+	if (karg.build_id_size) {
+		__u32 build_id_sz;
+

fs/proc/task_mmu.c +8 -0

+			}
+			karg.build_id_size = build_id_sz;
+		}
+	}
+
+	if (vm_file)
+		fput(vm_file);
+
 	if (karg.vma_name_size && copy_to_user(u64_to_user_ptr(karg.vma_name_addr),
 					       name, karg.vma_name_size)) {
 		kfree(name_buf);

Quoted 7 lines · Andrii Nakryiko

      /* unlock vma or mmap_lock, and put mm_struct before copying data to user */
      query_vma_teardown(&lock_ctx);
      mmput(mm);

fs/proc/task_mmu.c +3 -0

+     if (karg.build_id_size) {
+             __u32 build_id_sz;
+

fs/proc/task_mmu.c static int do_procmap_query(struct mm_struct *mm, void __user *uarg) · line 783

Quoted 10 lines

fs/proc/task_mmu.c +10 -0

+             if (vm_file)
+                     err = build_id_parse_file(vm_file, build_id_buf, &build_id_sz);
+             else
+                     err = -ENOENT;
+             if (err) {
+                     karg.build_id_size = 0;
+             } else {
+                     if (karg.build_id_size < build_id_sz) {
+                             err = -ENAMETOOLONG;
+                             goto out;

Introduces a double mmput() here.

Quoted 12 lines

fs/proc/task_mmu.c +8 -0

+                     }
+                     karg.build_id_size = build_id_sz;
+             }
+     }
+
+     if (vm_file)
+             fput(vm_file);
+
      if (karg.vma_name_size && copy_to_user(u64_to_user_ptr(karg.vma_name_addr),
                                             name, karg.vma_name_size)) {
              kfree(name_buf);

fs/proc/task_mmu.c static int do_procmap_query(struct mm_struct *mm, void __user *uarg) · line 814

Quoted 7 lines

fs/proc/task_mmu.c +2 -0

@@ -798,6 +808,8 @@ static int do_procmap_query(struct mm_struct *mm, void __user *uarg)
 out:
      query_vma_teardown(&lock_ctx);
      mmput(mm);
+     if (vm_file)
+             fput(vm_file);
      kfree(name_buf);
      return err;

See:

        https://lore.kernel.org/all/[email protected]/T/#u

Thanks

tglx

A recent fix moved the build ID evaluation past the mmput() of the success path but kept the error goto unchanged, which ends up in doing another quert_vma_teardown() and another mmput().

Change the goto so it jumps past the mmput() and only puts the file and the buffer.

Fixes b5cbacd7f86f ("procfs: avoid fetching build ID while holding VMA lock")

Reported-by [email protected]

Signed-off-by Thomas Gleixner <[email protected]>

Closes https://lore.kernel.org/[email protected]/T/#u open here

Quoted 7 lines · Thomas Gleixner

A recent fix moved the build ID evaluation past the mmput() of the success path but kept the error goto unchanged, which ends up in doing another quert_vma_teardown() and another mmput().

Change the goto so it jumps past the mmput() and only puts the file and the buffer.

Quoted 4 lines

Fixes b5cbacd7f86f ("procfs: avoid fetching build ID while holding VMA lock")

Reported-by [email protected]

Signed-off-by Thomas Gleixner <[email protected]>

Closes https://lore.kernel.org/[email protected]/T/#u open here

Reviewed-by Sebastian Andrzej Siewior <[email protected]>

Sebastian

We raced with Thomas sending the same fix, I see that my patch was staged by Andrew already in [0], just FYI