Andrey Ryabinin 624483f3ea mm: rmap: fix use-after-free in __put_anon_vma ...

While working address sanitizer for kernel I've discovered
use-after-free bug in __put_anon_vma.

For the last anon_vma, anon_vma->root freed before child anon_vma.
Later in anon_vma_free(anon_vma) we are referencing to already freed
anon_vma->root to check rwsem.

This fixes it by freeing the child anon_vma before freeing
anon_vma->root.

Signed-off-by: Andrey Ryabinin <a.ryabinin@samsung.com>
Acked-by: Peter Zijlstra <peterz@infradead.org>
Cc: <stable@vger.kernel.org> # v3.0+
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

2014-06-06 08:53:41 -07:00

..

backing-dev.c

bdi: avoid oops on device removal

2014-04-03 16:20:49 -07:00

balloon_compaction.c

…

bootmem.c

…

bounce.c

…

cleancache.c

…

compaction.c

mm/compaction: make isolate_freepages start at pageblock boundary

2014-05-06 13:04:59 -07:00

debug-pagealloc.c

…

dmapool.c

…

early_ioremap.c

mm: create generic early_ioremap() support

2014-04-07 16:36:15 -07:00

fadvise.c

…

failslab.c

…

filemap_xip.c

…

filemap.c

mm/filemap.c: avoid always dirtying mapping->flags on O_DIRECT

2014-05-23 09:37:29 -07:00

fremap.c

mm: fix bad rss-counter if remap_file_pages raced migration

2014-03-19 16:21:49 -07:00

frontswap.c

…

highmem.c

…

huge_memory.c

thp: close race between split and zap huge pages

2014-04-18 16:40:09 -07:00

hugetlb_cgroup.c

cgroup: drop const from @buffer of cftype->write_string()

2014-03-19 10:23:54 -04:00

hugetlb.c

hugetlb: ensure hugepage access is denied if hugepages are not supported

2014-05-06 13:04:58 -07:00

hwpoison-inject.c

…

init-mm.c

…

internal.h

mm/readahead.c: inline ra_submit

2014-04-07 16:35:58 -07:00

interval_tree.c

…

iov_iter.c

take iov_iter stuff to mm/iov_iter.c

2014-04-01 23:19:30 -04:00

Kconfig

parisc,metag: Do not hardcode maximum userspace stack size

2014-05-15 00:01:41 +01:00

Kconfig.debug

…

kmemcheck.c

…

kmemleak-test.c

…

kmemleak.c

mm: postpone the disabling of kmemleak early logging

2014-05-11 17:55:48 +09:00

ksm.c

mm: close PageTail race

2014-03-04 07:55:47 -08:00

list_lru.c

mm: keep page cache radix tree nodes in check

2014-04-03 16:21:01 -07:00

maccess.c

…

madvise.c

mm: madvise: fix MADV_WILLNEED on shmem swapouts

2014-05-23 09:37:29 -07:00

Makefile

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2014-04-12 14:49:50 -07:00

memblock.c

mm/memblock.c: use PFN_PHYS()

2014-04-07 16:35:58 -07:00

memcontrol.c

memcg: fix swapcache charge from kernel thread context

2014-05-23 09:37:29 -07:00

memory_hotplug.c

…

memory-failure.c

mm/memory-failure.c: fix memory leak by race between poison and unpoison

2014-05-23 09:37:30 -07:00

memory.c

mm: split 'tlb_flush_mmu()' into tlb flushing and memory freeing parts

2014-04-25 16:05:40 -07:00

mempolicy.c

mm, mempolicy: remove per-process flag

2014-04-07 16:35:54 -07:00

mempool.c

mempool: add unlikely and likely hints

2014-04-07 16:35:55 -07:00

migrate.c

mm: fix swapops.h:131 bug if remap_file_pages raced migration

2014-03-20 22:09:09 -07:00

mincore.c

mm + fs: prepare for non-page entries in page cache radix trees

2014-04-03 16:21:00 -07:00

mlock.c

mm: try_to_unmap_cluster() should lock_page() before mlocking

2014-04-07 16:35:57 -07:00

mm_init.c

mm: bring back /sys/kernel/mm

2014-01-27 21:02:39 -08:00

mmap.c

mm: per-thread vma caching

2014-04-07 16:35:53 -07:00

mmu_context.c

sched/mm: call finish_arch_post_lock_switch in idle_task_exit and use_mm

2014-02-21 08:50:17 +01:00

mmu_notifier.c

…

mmzone.c

…

mprotect.c

mm: move mmu notifier call from change_protection to change_pmd_range

2014-04-07 16:35:50 -07:00

mremap.c

mm, thp: close race between mremap() and split_huge_page()

2014-05-11 17:55:48 +09:00

msync.c

…

nobootmem.c

mm/nobootmem.c: mark function as static

2014-04-03 16:21:02 -07:00

nommu.c

mm: fix 'ERROR: do not initialise globals to 0 or NULL' and coding style

2014-04-07 16:35:55 -07:00

oom_kill.c

mm, oom: base root bonus on current usage

2014-01-30 16:56:56 -08:00

page_alloc.c

mm/page_alloc.c: change mm debug routines back to EXPORT_SYMBOL

2014-04-07 16:35:59 -07:00

page_cgroup.c

mm/page_cgroup.c: mark functions as static

2014-04-03 16:21:02 -07:00

page_io.c

Merge branch 'for-3.14/core' of git://git.kernel.dk/linux-block

2014-01-30 11:19:05 -08:00

page_isolation.c

…

page-writeback.c

mm/page-writeback.c: fix divide by zero in pos_ratio_polynom

2014-05-06 13:04:58 -07:00

pagewalk.c

…

percpu-km.c

…

percpu-vm.c

…

percpu.c

percpu: make pcpu_alloc_chunk() use pcpu_mem_free() instead of kfree()

2014-04-14 16:18:06 -04:00

pgtable-generic.c

…

process_vm_access.c

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2014-04-12 14:49:50 -07:00

quicklist.c

…

readahead.c

mm/readahead.c: inline ra_submit

2014-04-07 16:35:58 -07:00

rmap.c

mm: rmap: fix use-after-free in __put_anon_vma

2014-06-06 08:53:41 -07:00

shmem.c

mm: Initialize error in shmem_file_aio_read()

2014-04-13 14:10:26 -07:00

slab_common.c

slub: use sysfs'es release mechanism for kmem_cache

2014-05-06 13:04:59 -07:00

slab.c

slab: Fix off by one in object max number tests.

2014-05-05 20:38:49 -07:00

slab.h

slub: use sysfs'es release mechanism for kmem_cache

2014-05-06 13:04:59 -07:00

slob.c

mm: slab/slub: use page->list consistently instead of page->lru

2014-04-11 10:06:06 +03:00

slub.c

slub: use sysfs'es release mechanism for kmem_cache

2014-05-06 13:04:59 -07:00

sparse-vmemmap.c

…

sparse.c

mm: use macros from compiler.h instead of __attribute__((...))

2014-04-07 16:35:54 -07:00

swap_state.c

swap: add a simple detector for inappropriate swapin readahead

2014-02-06 13:48:51 -08:00

swap.c

mm: thrash detection-based file cache sizing

2014-04-03 16:21:01 -07:00

swapfile.c

mm/swap: fix race on swap_info reuse between swapoff and swapon

2014-02-06 13:48:51 -08:00

truncate.c

mm: filemap: update find_get_pages_tag() to deal with shadow entries

2014-05-06 13:04:59 -07:00

util.c

nick kvfree() from apparmor

2014-05-06 14:02:53 -04:00

vmacache.c

mm: don't pointlessly use BUG_ON() for sanity check

2014-04-28 14:24:09 -07:00

vmalloc.c

mm/vmalloc.c: enhance vm_map_ram() comment

2014-04-07 16:35:55 -07:00

vmpressure.c

arm, pm, vmpressure: add missing slab.h includes

2014-02-03 13:24:01 -05:00

vmscan.c

revert "mm: vmscan: do not swap anon pages just because free+file is low"

2014-05-06 13:04:59 -07:00

vmstat.c

Merge tag 'cpu-hotplug-3.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm

2014-04-07 14:55:46 -07:00

workingset.c

mm: keep page cache radix tree nodes in check

2014-04-03 16:21:01 -07:00

zbud.c

…

zsmalloc.c

zsmalloc: Fix CPU hotplug callback registration

2014-03-20 13:43:45 +01:00

zswap.c

Merge branch 'akpm' (incoming from Andrew)

2014-04-07 16:38:06 -07:00