Jann Horn 6dbfc25d68
mm/rmap: Fix anon_vma->degree ambiguity leading to double-reuse ...
commit 2555283eb40df89945557273121e9393ef9b542b upstream.
anon_vma->degree tracks the combined number of child anon_vmas and VMAs
that use the anon_vma as their ->anon_vma.
anon_vma_clone() then assumes that for any anon_vma attached to
src->anon_vma_chain other than src->anon_vma, it is impossible for it to
be a leaf node of the VMA tree, meaning that for such VMAs ->degree is
elevated by 1 because of a child anon_vma, meaning that if ->degree
equals 1 there are no VMAs that use the anon_vma as their ->anon_vma.
This assumption is wrong because the ->degree optimization leads to leaf
nodes being abandoned on anon_vma_clone() - an existing anon_vma is
reused and no new parent-child relationship is created. So it is
possible to reuse an anon_vma for one VMA while it is still tied to
another VMA.
This is an issue because is_mergeable_anon_vma() and its callers assume
that if two VMAs have the same ->anon_vma, the list of anon_vmas
attached to the VMAs is guaranteed to be the same. When this assumption
is violated, vma_merge() can merge pages into a VMA that is not attached
to the corresponding anon_vma, leading to dangling page->mapping
pointers that will be dereferenced during rmap walks.
Fix it by separately tracking the number of child anon_vmas and the
number of VMAs using the anon_vma as their ->anon_vma.
Fixes: 7a3ef208e6stable@kernel.org
Acked-by: Michal Hocko <mhocko@suse.com >
Acked-by: Vlastimil Babka <vbabka@suse.cz >
Signed-off-by: Jann Horn <jannh@google.com >
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org >
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org >
2022-09-05 10:26:34 +02:00
2019-12-13 08:51:18 +01:00
2021-03-17 16:43:42 +01:00
2020-04-02 15:28:16 +02:00
2019-12-05 09:20:15 +01:00
2020-04-29 16:31:24 +02:00
2020-01-27 14:50:42 +01:00
2022-08-25 11:15:23 +02:00
2021-06-16 11:55:01 +02:00
2022-03-16 13:20:26 +01:00
2020-10-01 13:14:28 +02:00
2022-06-14 16:59:39 +02:00
2021-03-30 14:37:02 +02:00
2022-09-05 10:26:29 +02:00
2020-01-27 14:51:19 +01:00
2021-09-22 11:47:49 +02:00
2020-06-30 23:17:12 -04:00
2020-01-23 08:21:39 +01:00
2021-12-08 08:50:11 +01:00
2021-05-22 10:59:30 +02:00
2022-04-15 14:14:39 +02:00
2022-08-25 11:14:57 +02:00
2021-05-07 10:49:25 +02:00
2020-01-09 10:19:01 +01:00
2022-03-23 09:10:43 +01:00
2019-12-13 08:52:59 +01:00
2021-08-08 08:54:29 +02:00
2021-08-08 08:54:29 +02:00
2020-08-19 08:15:05 +02:00
2019-12-01 09:17:07 +01:00
2020-06-25 15:33:02 +02:00
2022-04-15 14:14:41 +02:00
2019-10-05 13:10:03 +02:00
2022-04-15 14:14:37 +02:00
2020-04-29 16:31:17 +02:00
2021-09-22 11:47:59 +02:00
2022-06-14 16:59:21 +02:00
2022-08-25 11:14:51 +02:00
2019-10-05 13:09:54 +02:00
2020-12-30 11:25:39 +01:00
2020-09-09 19:04:31 +02:00
2021-09-26 13:39:48 +02:00
2019-08-16 10:12:38 +02:00
2022-07-21 21:09:26 +02:00
2020-07-22 09:32:00 +02:00
2019-08-06 19:06:52 +02:00
2019-08-06 19:06:52 +02:00
2021-01-30 13:32:11 +01:00
2021-03-24 11:07:31 +01:00
2020-12-30 11:25:40 +01:00
2021-01-23 15:49:55 +01:00
2021-10-06 15:31:17 +02:00
2021-05-26 11:48:35 +02:00
2021-11-26 11:36:02 +01:00
2022-06-16 13:18:52 +02:00
2019-11-20 18:47:11 +01:00
2019-12-31 16:36:22 +01:00
2022-06-25 11:49:07 +02:00
2019-11-24 08:20:07 +01:00
2021-10-06 15:31:28 +02:00
2020-11-05 11:08:35 +01:00
2020-10-01 13:14:28 +02:00
2020-04-17 10:48:45 +02:00
2021-03-04 09:39:57 +01:00
2021-08-26 08:36:41 -04:00
2021-01-23 15:49:55 +01:00
2022-05-25 09:10:41 +02:00
2020-02-24 08:34:44 +01:00
2019-11-20 18:47:40 +01:00
2021-03-11 14:05:02 +01:00
2022-06-14 16:59:20 +02:00
2021-10-27 09:53:13 +02:00
2020-06-25 15:33:02 +02:00
2022-04-27 13:39:41 +02:00
2020-02-11 04:34:08 -08:00
2021-04-07 12:48:50 +02:00
2019-11-24 08:19:14 +01:00
2021-12-08 08:50:13 +01:00
2021-11-26 11:35:59 +01:00
2020-10-14 10:31:21 +02:00
2021-12-08 08:50:13 +01:00
2021-09-22 11:47:56 +02:00
2021-09-22 11:47:56 +02:00
2020-11-05 11:08:35 +01:00
2019-11-20 18:45:55 +01:00
2021-01-30 13:32:12 +01:00
2019-12-05 09:21:03 +01:00
2021-03-11 14:04:59 +01:00
2019-11-10 11:27:40 +01:00
2019-09-10 10:33:44 +01:00
2022-01-27 09:04:25 +01:00
2020-11-05 11:08:54 +01:00
2020-01-04 19:13:32 +01:00
2021-07-11 12:49:27 +02:00
2021-09-22 11:48:09 +02:00
2022-06-25 11:49:07 +02:00
2019-10-17 13:45:42 -07:00
2020-08-11 15:32:33 +02:00
2020-09-23 12:10:59 +02:00
2021-05-22 10:59:40 +02:00
2021-03-04 09:39:59 +01:00
2019-12-05 09:19:39 +01:00
2020-05-10 10:30:12 +02:00
2022-03-23 09:10:44 +01:00
2020-01-12 12:17:25 +01:00
2021-03-30 14:37:00 +02:00
2019-08-09 17:52:34 +02:00
2020-07-22 09:32:00 +02:00
2020-03-18 07:14:11 +01:00
2021-08-26 08:36:39 -04:00
2021-02-03 23:23:26 +01:00
2020-02-28 16:38:59 +01:00
2020-07-29 10:16:57 +02:00
2020-05-10 10:30:11 +02:00
2020-04-17 10:48:41 +02:00
2021-05-22 10:59:50 +02:00
2021-12-08 08:50:11 +01:00
2019-12-31 16:35:23 +01:00
2021-03-04 09:39:59 +01:00
2021-08-26 08:36:40 -04:00
2020-02-28 16:38:50 +01:00
2019-12-13 08:52:43 +01:00
2020-07-16 08:17:26 +02:00
2021-01-09 13:43:48 +01:00
2022-05-12 12:20:20 +02:00
2019-12-13 08:52:43 +01:00
2022-07-02 16:27:39 +02:00
2020-04-23 10:30:24 +02:00
2021-03-04 09:39:44 +01:00
2022-08-25 11:15:23 +02:00
2020-06-22 09:05:15 +02:00
2020-10-14 10:31:26 +02:00
2021-12-08 08:50:12 +01:00
2021-02-07 14:48:38 +01:00
2022-08-25 11:15:31 +02:00
2020-04-29 16:31:19 +02:00
2021-11-26 11:35:57 +01:00
2020-01-04 19:13:15 +01:00
2020-02-24 08:34:46 +01:00
2021-09-22 11:47:57 +02:00
2020-09-09 19:04:28 +02:00
2019-09-06 10:22:19 +02:00
2021-11-26 11:35:56 +01:00
2022-06-14 16:59:25 +02:00
2021-04-28 13:16:51 +02:00
2021-10-09 14:11:03 +02:00
2020-02-11 04:34:18 -08:00
2021-09-22 11:48:12 +02:00
2020-01-29 16:43:27 +01:00
2019-12-31 16:35:38 +01:00
2019-11-12 19:20:36 +01:00
2022-06-25 11:49:12 +02:00
2021-07-11 12:49:26 +02:00
2022-04-15 14:15:07 +02:00
2020-07-29 10:16:52 +02:00
2021-05-22 10:59:23 +02:00
2021-08-26 08:36:41 -04:00
2021-03-30 14:37:02 +02:00
2021-06-30 08:48:18 -04:00
2022-05-18 09:42:47 +02:00
2022-04-15 14:14:36 +02:00
2020-11-18 19:18:44 +01:00
2020-11-18 19:18:44 +01:00
2020-12-02 08:48:07 +01:00
2022-04-15 14:15:03 +02:00
2020-10-01 13:14:41 +02:00
2019-09-06 10:22:23 +02:00
2022-08-25 11:15:46 +02:00
2020-10-07 08:00:08 +02:00
2022-06-14 16:59:38 +02:00
2020-04-13 10:45:06 +02:00
2020-04-17 10:48:45 +02:00
2021-12-08 08:50:11 +01:00
2021-01-06 14:45:00 +01:00
2021-09-03 09:58:00 +02:00
2020-10-29 09:55:15 +01:00
2020-10-30 10:38:20 +01:00
2021-08-08 08:54:30 +02:00
2020-03-25 08:06:13 +01:00
2021-07-11 12:49:30 +02:00
2022-08-25 11:14:56 +02:00
2020-04-17 10:48:46 +02:00
2022-04-15 14:14:50 +02:00
2020-04-23 10:30:20 +02:00
2020-02-11 04:34:11 -08:00
2021-06-10 13:24:08 +02:00
2020-03-18 07:14:17 +01:00
2020-01-27 14:50:26 +01:00
2020-05-20 08:18:45 +02:00
2020-01-17 19:46:55 +01:00
2020-01-04 19:13:35 +01:00
2022-06-25 11:49:11 +02:00
2020-07-22 09:32:13 +02:00
2021-01-12 20:10:17 +01:00
2021-06-30 08:48:19 -04:00
2022-06-14 16:59:13 +02:00
2019-12-13 08:52:28 +01:00
2020-01-04 19:12:53 +01:00
2019-12-17 20:35:17 +01:00
2022-06-25 11:49:13 +02:00
2022-07-02 16:27:31 +02:00
2020-02-24 08:34:46 +01:00
2019-12-05 09:19:38 +01:00
2022-09-05 10:26:34 +02:00
2021-11-26 11:36:14 +01:00
2020-01-27 14:50:37 +01:00
2021-12-14 10:18:04 +01:00
2022-07-12 16:29:03 +02:00
2022-09-05 10:26:28 +02:00
2021-11-26 11:35:56 +01:00
2020-04-02 15:28:22 +02:00
2020-12-30 11:26:01 +01:00
2020-10-01 13:14:30 +02:00
2019-12-05 09:20:25 +01:00
2019-12-13 08:51:07 +01:00
2020-06-22 09:05:03 +02:00
2020-01-27 14:51:05 +01:00
2022-06-25 11:49:11 +02:00
2021-09-22 11:48:11 +02:00
2021-05-22 10:59:39 +02:00
2021-06-30 08:48:18 -04:00
2021-03-17 16:43:51 +01:00
2021-02-13 13:51:15 +01:00
2020-04-17 10:48:43 +02:00
2019-12-05 09:20:57 +01:00
2020-04-23 10:30:19 +02:00
2020-01-27 14:50:22 +01:00
2021-03-07 12:19:01 +01:00
2020-07-31 18:37:48 +02:00
2022-01-05 12:34:57 +01:00
2021-03-24 11:07:37 +01:00
2020-11-18 19:18:40 +01:00
2019-12-21 10:57:17 +01:00
2019-11-20 18:45:24 +01:00
2021-10-09 14:11:04 +02:00
2022-06-25 11:49:10 +02:00
2020-01-23 08:21:32 +01:00
2022-03-23 09:10:41 +01:00
2019-12-05 09:19:49 +01:00
2020-12-30 11:26:01 +01:00
2021-07-20 16:15:42 +02:00
2021-05-22 10:59:31 +02:00
2022-07-29 17:10:37 +02:00
2020-12-11 13:25:01 +01:00
2021-03-30 14:36:58 +02:00
2020-09-09 19:04:29 +02:00
2021-03-24 11:07:34 +01:00
2022-03-16 13:20:27 +01:00
2021-12-29 12:20:44 +01:00
2020-10-07 08:00:05 +02:00
2022-03-16 13:20:27 +01:00
2020-04-29 16:31:27 +02:00
2020-04-02 15:28:23 +02:00
2021-12-14 10:18:06 +01:00
2020-08-11 15:32:34 +02:00
2021-03-07 12:19:01 +01:00
6dbfc25d68