Files
linux-stable-mirror/include/linux
Jann Horn c18a209b56 mm/rmap: Fix anon_vma->degree ambiguity leading to double-reuse
commit 2555283eb4 upstream.

anon_vma->degree tracks the combined number of child anon_vmas and VMAs
that use the anon_vma as their ->anon_vma.

anon_vma_clone() then assumes that for any anon_vma attached to
src->anon_vma_chain other than src->anon_vma, it is impossible for it to
be a leaf node of the VMA tree, meaning that for such VMAs ->degree is
elevated by 1 because of a child anon_vma, meaning that if ->degree
equals 1 there are no VMAs that use the anon_vma as their ->anon_vma.

This assumption is wrong because the ->degree optimization leads to leaf
nodes being abandoned on anon_vma_clone() - an existing anon_vma is
reused and no new parent-child relationship is created.  So it is
possible to reuse an anon_vma for one VMA while it is still tied to
another VMA.

This is an issue because is_mergeable_anon_vma() and its callers assume
that if two VMAs have the same ->anon_vma, the list of anon_vmas
attached to the VMAs is guaranteed to be the same.  When this assumption
is violated, vma_merge() can merge pages into a VMA that is not attached
to the corresponding anon_vma, leading to dangling page->mapping
pointers that will be dereferenced during rmap walks.

Fix it by separately tracking the number of child anon_vmas and the
number of VMAs using the anon_vma as their ->anon_vma.

Fixes: 7a3ef208e6 ("mm: prevent endless growth of anon_vma hierarchy")
Cc: stable@kernel.org
Acked-by: Michal Hocko <mhocko@suse.com>
Acked-by: Vlastimil Babka <vbabka@suse.cz>
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-09-05 10:30:07 +02:00
..
2022-08-25 11:40:05 +02:00
2022-08-17 14:23:11 +02:00
2022-08-31 17:16:34 +02:00
2021-12-14 10:57:11 +01:00
2022-07-07 17:53:26 +02:00
2021-11-25 09:48:41 +01:00
2022-04-13 20:59:03 +02:00
2022-08-17 14:24:08 +02:00
2022-07-23 12:53:57 +02:00
2021-11-18 19:15:51 +01:00
2022-07-12 16:35:08 +02:00
2022-06-09 10:23:32 +02:00
2022-07-02 16:41:17 +02:00
2021-10-07 16:51:57 +02:00
2022-07-12 16:35:08 +02:00
2021-11-21 13:44:12 +01:00
2022-07-29 17:25:32 +02:00