Jann Horn
c18a209b56
mm/rmap: Fix anon_vma->degree ambiguity leading to double-reuse
...
commit 2555283eb4 upstream.
anon_vma->degree tracks the combined number of child anon_vmas and VMAs
that use the anon_vma as their ->anon_vma.
anon_vma_clone() then assumes that for any anon_vma attached to
src->anon_vma_chain other than src->anon_vma, it is impossible for it to
be a leaf node of the VMA tree, meaning that for such VMAs ->degree is
elevated by 1 because of a child anon_vma, meaning that if ->degree
equals 1 there are no VMAs that use the anon_vma as their ->anon_vma.
This assumption is wrong because the ->degree optimization leads to leaf
nodes being abandoned on anon_vma_clone() - an existing anon_vma is
reused and no new parent-child relationship is created. So it is
possible to reuse an anon_vma for one VMA while it is still tied to
another VMA.
This is an issue because is_mergeable_anon_vma() and its callers assume
that if two VMAs have the same ->anon_vma, the list of anon_vmas
attached to the VMAs is guaranteed to be the same. When this assumption
is violated, vma_merge() can merge pages into a VMA that is not attached
to the corresponding anon_vma, leading to dangling page->mapping
pointers that will be dereferenced during rmap walks.
Fix it by separately tracking the number of child anon_vmas and the
number of VMAs using the anon_vma as their ->anon_vma.
Fixes: 7a3ef208e6 ("mm: prevent endless growth of anon_vma hierarchy")
Cc: stable@kernel.org
Acked-by: Michal Hocko <mhocko@suse.com >
Acked-by: Vlastimil Babka <vbabka@suse.cz >
Signed-off-by: Jann Horn <jannh@google.com >
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org >
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org >
2022-09-05 10:30:07 +02:00
..
2022-04-08 14:23:57 +02:00
2022-05-25 09:57:28 +02:00
2021-11-18 19:17:06 +01:00
2022-06-09 10:23:07 +02:00
2022-08-17 14:23:55 +02:00
2022-08-17 14:22:47 +02:00
2022-08-17 14:24:09 +02:00
2022-08-31 17:16:39 +02:00
2022-06-09 10:23:25 +02:00
2022-04-27 14:39:01 +02:00
2022-08-31 17:16:40 +02:00
2022-06-09 10:23:06 +02:00
2022-07-12 16:34:53 +02:00
2022-08-17 14:23:01 +02:00
2022-04-20 09:34:04 +02:00
2022-08-17 14:23:48 +02:00
2021-10-14 12:47:29 +01:00
2022-08-25 11:40:05 +02:00
2021-11-18 19:15:59 +01:00
2022-08-17 14:22:58 +02:00
2022-08-17 14:23:11 +02:00
2021-12-08 09:04:41 +01:00
2022-08-17 14:23:11 +02:00
2022-03-11 12:22:34 +01:00
2022-06-22 14:22:02 +02:00
2022-04-08 14:24:17 +02:00
2022-07-29 17:25:25 +02:00
2022-07-12 16:34:57 +02:00
2022-04-08 14:22:59 +02:00
2022-01-27 11:04:15 +01:00
2022-08-31 17:16:34 +02:00
2021-10-26 12:35:16 -07:00
2022-05-01 17:22:24 +02:00
2021-11-18 19:16:20 +01:00
2022-07-12 16:34:54 +02:00
2022-08-25 11:40:02 +02:00
2022-08-17 14:22:46 +02:00
2021-11-18 19:17:21 +01:00
2022-07-21 21:24:13 +02:00
2022-06-09 10:22:48 +02:00
2022-07-12 16:35:01 +02:00
2022-07-12 16:35:01 +02:00
2022-07-12 16:35:01 +02:00
2022-02-23 12:03:17 +01:00
2021-11-18 19:16:03 +01:00
2022-04-08 14:24:18 +02:00
2022-07-23 12:54:02 +02:00
2021-11-18 19:16:45 +01:00
2022-05-30 09:29:09 +02:00
2022-08-31 17:16:35 +02:00
2021-12-14 10:57:11 +01:00
2022-07-07 17:53:26 +02:00
2021-11-18 19:16:00 +01:00
2022-04-08 14:24:13 +02:00
2021-11-25 09:48:41 +01:00
2022-06-09 10:22:47 +02:00
2021-10-18 20:22:03 -10:00
2022-04-27 14:38:50 +02:00
2021-11-18 19:17:06 +01:00
2022-03-08 19:12:39 +01:00
2022-06-14 18:36:06 +02:00
2022-06-14 18:36:21 +02:00
2022-04-08 14:22:59 +02:00
2022-07-12 16:35:09 +02:00
2022-03-08 19:12:40 +01:00
2021-11-18 19:16:25 +01:00
2022-01-20 09:13:13 +01:00
2022-07-02 16:41:17 +02:00
2022-01-11 15:35:11 +01:00
2022-02-01 17:27:15 +01:00
2022-06-09 10:22:47 +02:00
2022-03-16 14:23:46 +01:00
2022-06-09 10:23:20 +02:00
2022-01-27 11:04:41 +01:00
2022-07-12 16:35:06 +02:00
2022-05-30 09:29:09 +02:00
2022-08-17 14:23:29 +02:00
2022-03-23 09:16:42 +01:00
2021-12-29 12:28:49 +01:00
2022-08-25 11:40:41 +02:00
2022-05-01 17:22:32 +02:00
2022-05-25 09:57:22 +02:00
2022-08-11 13:07:50 +02:00
2021-11-25 09:48:42 +01:00
2022-04-13 20:59:03 +02:00
2022-03-08 19:12:32 +01:00
2022-06-14 18:36:23 +02:00
2022-03-08 19:12:38 +01:00
2021-11-18 19:16:13 +01:00
2022-05-09 09:14:30 +02:00
2022-07-21 21:24:29 +02:00
2022-04-27 14:38:51 +02:00
2022-08-17 14:24:08 +02:00
2021-12-08 09:04:41 +01:00
2022-07-23 12:53:57 +02:00
2021-11-18 19:15:51 +01:00
2022-07-12 16:35:08 +02:00
2022-08-17 14:23:08 +02:00
2021-11-12 15:05:48 +01:00
2021-11-12 15:05:48 +01:00
2022-06-09 10:23:12 +02:00
2022-08-17 14:22:57 +02:00
2022-05-25 09:57:26 +02:00
2022-01-05 12:42:33 +01:00
2022-08-31 17:16:48 +02:00
2021-10-18 20:22:02 -10:00
2022-07-12 16:35:10 +02:00
2022-08-17 14:23:43 +02:00
2021-12-14 10:57:22 +01:00
2022-07-12 16:35:17 +02:00
2022-04-13 20:59:28 +02:00
2022-07-02 16:41:16 +02:00
2021-11-18 19:17:14 +01:00
2022-06-09 10:23:32 +02:00
2022-05-18 10:26:47 +02:00
2022-08-31 17:16:44 +02:00
2022-06-09 10:23:17 +02:00
2022-06-09 10:23:17 +02:00
2022-02-16 12:56:09 +01:00
2022-08-25 11:40:43 +02:00
2022-06-14 18:36:24 +02:00
2022-04-08 14:24:09 +02:00
2022-03-02 11:48:06 +01:00
2022-07-23 12:54:08 +02:00
2022-01-27 11:04:15 +01:00
2022-03-08 19:12:42 +01:00
2022-08-17 14:23:14 +02:00
2021-10-28 17:18:55 -07:00
2022-05-01 17:22:29 +02:00
2022-03-16 14:23:46 +01:00
2022-08-17 14:22:57 +02:00
2022-04-08 14:23:37 +02:00
2022-02-01 17:27:10 +01:00
2022-02-08 18:34:05 +01:00
2022-07-07 17:53:24 +02:00
2022-08-17 14:22:51 +02:00
2022-07-12 16:35:09 +02:00
2022-07-02 16:41:17 +02:00
2021-11-18 19:17:14 +01:00
2022-05-30 09:29:15 +02:00
2021-11-25 09:48:45 +01:00
2022-02-01 17:27:01 +01:00
2022-02-01 17:27:15 +01:00
2022-04-08 14:23:01 +02:00
2022-06-09 10:23:01 +02:00
2022-01-27 11:03:52 +01:00
2022-06-09 10:22:29 +02:00
2021-10-07 16:51:57 +02:00
2022-06-14 18:36:27 +02:00
2022-04-08 14:23:06 +02:00
2022-06-29 09:03:17 +02:00
2022-07-21 21:24:15 +02:00
2022-09-05 10:30:07 +02:00
2021-11-18 19:16:58 +01:00
2022-07-12 16:35:17 +02:00
2022-08-17 14:24:14 +02:00
2021-10-18 20:22:03 -10:00
2022-05-25 09:57:37 +02:00
2022-07-12 16:35:08 +02:00
2022-07-21 21:24:43 +02:00
2021-11-18 19:16:01 +01:00
2022-05-30 09:29:15 +02:00
2022-09-05 10:30:07 +02:00
2022-09-05 10:30:07 +02:00
2022-04-13 20:59:28 +02:00
2022-04-13 20:59:28 +02:00
2022-04-13 20:59:28 +02:00
2022-07-12 16:35:03 +02:00
2022-05-12 12:30:05 +02:00
2021-11-21 13:44:12 +01:00
2022-02-16 12:56:19 +01:00
2022-04-08 14:24:17 +02:00
2022-07-29 17:25:11 +02:00
2022-07-21 21:24:35 +02:00
2022-03-02 11:47:51 +01:00
2022-05-30 09:29:13 +02:00
2022-08-17 14:23:22 +02:00
2022-08-17 14:24:28 +02:00
2021-11-18 19:16:41 +01:00
2021-11-25 09:48:34 +01:00
2021-10-18 18:12:09 -04:00
2022-07-29 17:25:32 +02:00
2022-08-25 11:40:34 +02:00
2022-05-01 17:22:33 +02:00
2021-10-18 16:02:30 -05:00
2022-04-20 09:34:13 +02:00
2022-03-16 14:23:43 +01:00
2021-12-29 12:28:43 +01:00
2022-03-16 14:23:43 +01:00
2022-07-12 16:35:01 +02:00
2022-08-17 14:23:01 +02:00
2022-03-16 14:23:44 +01:00