Jann Horn
98f401d363
mm/rmap: Fix anon_vma->degree ambiguity leading to double-reuse
...
commit 2555283eb4 upstream.
anon_vma->degree tracks the combined number of child anon_vmas and VMAs
that use the anon_vma as their ->anon_vma.
anon_vma_clone() then assumes that for any anon_vma attached to
src->anon_vma_chain other than src->anon_vma, it is impossible for it to
be a leaf node of the VMA tree, meaning that for such VMAs ->degree is
elevated by 1 because of a child anon_vma, meaning that if ->degree
equals 1 there are no VMAs that use the anon_vma as their ->anon_vma.
This assumption is wrong because the ->degree optimization leads to leaf
nodes being abandoned on anon_vma_clone() - an existing anon_vma is
reused and no new parent-child relationship is created. So it is
possible to reuse an anon_vma for one VMA while it is still tied to
another VMA.
This is an issue because is_mergeable_anon_vma() and its callers assume
that if two VMAs have the same ->anon_vma, the list of anon_vmas
attached to the VMAs is guaranteed to be the same. When this assumption
is violated, vma_merge() can merge pages into a VMA that is not attached
to the corresponding anon_vma, leading to dangling page->mapping
pointers that will be dereferenced during rmap walks.
Fix it by separately tracking the number of child anon_vmas and the
number of VMAs using the anon_vma as their ->anon_vma.
Fixes: 7a3ef208e6 ("mm: prevent endless growth of anon_vma hierarchy")
Cc: stable@kernel.org
Acked-by: Michal Hocko <mhocko@suse.com >
Acked-by: Vlastimil Babka <vbabka@suse.cz >
Signed-off-by: Jann Horn <jannh@google.com >
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org >
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org >
2022-09-05 10:28:56 +02:00
..
2022-04-08 14:40:02 +02:00
2021-04-14 08:42:06 +02:00
2021-04-07 15:00:07 +02:00
2022-05-25 09:17:56 +02:00
2021-05-14 09:50:05 +02:00
2022-06-09 10:21:15 +02:00
2022-06-14 18:32:41 +02:00
2022-08-21 15:16:09 +02:00
2021-06-16 12:01:44 +02:00
2022-06-14 18:32:36 +02:00
2021-05-11 14:47:14 +02:00
2022-08-21 15:16:16 +02:00
2022-08-25 11:38:11 +02:00
2021-04-21 13:00:56 +02:00
2022-08-31 17:15:17 +02:00
2022-06-09 10:21:14 +02:00
2021-09-15 09:50:26 +02:00
2022-05-15 20:00:08 +02:00
2022-07-21 21:19:59 +02:00
2022-04-08 14:40:07 +02:00
2021-03-04 11:38:14 +01:00
2021-09-08 08:49:01 +02:00
2022-05-18 10:23:48 +02:00
2022-08-21 15:15:26 +02:00
2021-03-09 11:11:13 +01:00
2021-12-08 09:03:20 +01:00
2022-03-11 12:11:52 +01:00
2022-04-08 14:40:44 +02:00
2021-07-14 16:56:53 +02:00
2022-07-29 17:19:25 +02:00
2022-08-21 15:15:45 +02:00
2021-06-03 09:00:45 +02:00
2022-04-08 14:39:55 +02:00
2021-01-12 20:18:17 +01:00
2022-01-27 10:54:08 +01:00
2021-11-21 13:46:35 +01:00
2022-08-21 15:15:36 +02:00
2021-08-04 12:46:41 +02:00
2022-01-27 10:53:54 +01:00
2021-09-03 10:09:31 +02:00
2022-08-03 12:00:52 +02:00
2021-03-30 14:32:05 +02:00
2022-08-21 15:15:19 +02:00
2021-09-26 14:08:59 +02:00
2021-11-18 14:04:32 +01:00
2022-07-21 21:20:00 +02:00
2022-01-27 10:54:05 +01:00
2021-07-20 16:05:46 +02:00
2021-07-20 16:05:46 +02:00
2021-07-20 16:05:46 +02:00
2021-09-30 10:11:07 +02:00
2021-05-26 12:06:56 +02:00
2021-11-18 14:03:49 +01:00
2021-06-03 09:00:45 +02:00
2021-05-28 13:17:43 +02:00
2022-04-08 14:40:45 +02:00
2022-07-25 11:26:40 +02:00
2022-05-30 09:33:36 +02:00
2021-09-08 08:49:00 +02:00
2021-03-09 11:11:13 +01:00
2021-06-30 08:47:18 -04:00
2021-03-30 14:32:06 +02:00
2021-08-18 08:59:17 +02:00
2022-07-07 17:52:17 +02:00
2021-01-19 18:27:22 +01:00
2022-05-25 09:17:55 +02:00
2021-03-11 14:17:27 +01:00
2022-06-09 10:21:01 +02:00
2021-05-19 10:13:13 +02:00
2021-10-27 09:56:51 +02:00
2021-09-15 09:50:37 +02:00
2021-03-17 17:06:36 +01:00
2022-04-27 13:53:45 +02:00
2021-11-18 14:04:25 +01:00
2021-09-18 13:40:21 +02:00
2021-03-04 11:38:41 +01:00
2021-04-07 15:00:11 +02:00
2022-07-12 16:32:18 +02:00
2021-11-18 14:03:42 +01:00
2022-06-09 10:20:49 +02:00
2022-01-20 09:17:49 +01:00
2021-11-26 10:39:22 +01:00
2021-09-08 08:48:59 +02:00
2020-12-30 11:54:18 +01:00
2022-02-01 17:25:48 +01:00
2022-01-27 10:54:16 +01:00
2021-06-18 10:00:04 +02:00
2021-09-15 09:50:25 +02:00
2021-07-25 14:36:18 +02:00
2021-09-18 13:40:36 +02:00
2021-09-18 13:40:36 +02:00
2022-05-30 09:33:36 +02:00
2021-05-19 10:12:54 +02:00
2021-03-04 11:38:46 +01:00
2022-03-23 09:13:28 +01:00
2021-03-30 14:31:57 +02:00
2021-08-18 08:59:13 +02:00
2021-09-18 13:40:14 +02:00
2021-05-14 09:50:32 +02:00
2021-12-01 09:19:10 +01:00
2022-04-13 21:00:56 +02:00
2021-08-18 08:59:15 +02:00
2022-06-14 18:32:44 +02:00
2021-01-09 13:46:23 +01:00
2021-11-18 14:03:56 +01:00
2022-05-09 09:04:59 +02:00
2022-07-21 21:20:11 +02:00
2021-03-04 11:37:59 +01:00
2022-08-21 15:16:08 +02:00
2021-03-04 11:38:46 +01:00
2021-03-04 11:38:20 +01:00
2021-12-08 09:03:20 +01:00
2021-02-07 15:37:17 +01:00
2022-08-21 15:16:24 +02:00
2021-11-18 14:03:37 +01:00
2021-02-03 23:28:40 +01:00
2021-09-30 10:11:04 +02:00
2021-09-15 09:50:41 +02:00
2021-09-15 09:50:41 +02:00
2022-08-21 15:15:33 +02:00
2022-06-09 10:21:09 +02:00
2022-06-09 10:21:09 +02:00
2022-06-09 10:21:18 +02:00
2021-04-21 13:01:00 +02:00
2022-05-25 09:17:54 +02:00
2021-10-09 14:40:56 +02:00
2022-01-05 12:40:29 +01:00
2022-02-23 12:00:56 +01:00
2021-09-22 12:27:59 +02:00
2021-03-17 17:06:25 +01:00
2022-07-12 16:32:18 +02:00
2021-03-04 11:38:21 +01:00
2021-06-03 09:00:45 +02:00
2021-06-23 14:42:49 +02:00
2022-08-21 15:15:21 +02:00
2021-06-30 08:47:26 -04:00
2021-03-30 14:32:06 +02:00
2022-05-15 20:00:09 +02:00
2021-08-18 08:59:17 +02:00
2021-03-30 14:32:07 +02:00
2022-05-18 10:23:42 +02:00
2022-08-31 17:15:21 +02:00
2022-04-13 21:01:03 +02:00
2021-05-19 10:13:02 +02:00
2022-08-25 11:38:20 +02:00
2022-06-14 18:32:45 +02:00
2021-02-07 15:37:16 +01:00
2022-07-25 11:26:47 +02:00
2021-07-19 09:44:39 +02:00
2021-03-09 11:11:13 +01:00
2021-09-03 10:09:21 +02:00
2021-06-30 08:47:29 -04:00
2022-08-21 15:16:18 +02:00
2021-05-19 10:13:01 +02:00
2021-05-19 10:13:01 +02:00
2022-06-22 14:13:20 +02:00
2022-02-01 17:25:45 +01:00
2022-02-08 18:30:35 +01:00
2021-03-30 14:32:05 +02:00
2022-06-06 08:42:41 +02:00
2021-05-14 09:50:14 +02:00
2022-07-12 16:32:18 +02:00
2021-05-19 10:12:51 +02:00
2021-11-18 14:04:29 +01:00
2022-05-30 09:33:43 +02:00
2020-12-30 11:53:56 +01:00
2022-02-05 12:37:55 +01:00
2022-02-05 12:37:55 +01:00
2022-04-08 14:39:56 +02:00
2021-06-23 14:42:45 +02:00
2022-06-09 10:20:49 +02:00
2021-04-07 15:00:13 +02:00
2022-05-30 09:33:45 +02:00
2022-06-29 08:59:44 +02:00
2021-09-18 13:40:19 +02:00
2022-09-05 10:28:56 +02:00
2021-11-18 14:04:22 +01:00
2022-07-12 16:32:22 +02:00
2021-01-09 13:46:24 +01:00
2022-08-31 17:15:14 +02:00
2022-06-09 10:21:09 +02:00
2021-11-18 14:04:27 +01:00
2021-03-17 17:06:34 +01:00
2022-07-21 21:20:19 +02:00
2022-05-30 09:33:43 +02:00
2022-09-05 10:28:56 +02:00
2022-09-05 10:28:56 +02:00
2021-05-14 09:50:46 +02:00
2021-06-23 14:42:44 +02:00
2021-09-03 10:09:30 +02:00
2021-09-03 10:09:30 +02:00
2021-03-30 14:31:53 +02:00
2021-03-30 14:31:53 +02:00
2022-05-12 12:25:32 +02:00
2021-03-17 17:06:34 +01:00
2022-02-16 12:54:22 +01:00
2021-07-25 14:36:17 +02:00
2021-07-25 14:36:18 +02:00
2021-05-07 11:04:32 +02:00
2021-01-17 14:16:59 +01:00
2022-03-02 11:42:47 +01:00
2022-06-09 10:21:11 +02:00
2021-03-25 09:04:16 +01:00
2021-09-16 12:51:23 +02:00
2022-05-30 09:33:41 +02:00
2022-03-08 19:09:34 +01:00
2022-08-21 15:16:22 +02:00
2021-11-18 14:04:11 +01:00
2021-11-26 10:39:14 +01:00
2021-07-14 16:55:46 +02:00
2021-05-14 09:50:18 +02:00
2022-07-29 17:19:28 +02:00
2021-03-04 11:37:36 +01:00
2021-05-14 09:50:18 +02:00
2021-03-30 14:31:51 +02:00
2022-08-25 11:38:14 +02:00
2021-05-14 09:50:31 +02:00
2021-02-17 11:02:28 +01:00
2021-03-25 09:04:14 +01:00
2021-03-17 17:06:19 +01:00
2021-09-08 08:49:00 +02:00
2021-03-30 14:32:03 +02:00
2022-08-21 15:16:07 +02:00
2022-03-16 14:16:02 +01:00
2021-12-29 12:25:56 +01:00
2022-03-16 14:16:01 +01:00
2021-02-10 09:29:21 +01:00
2022-08-21 15:15:29 +02:00
2022-03-16 14:16:03 +01:00
2021-04-07 15:00:06 +02:00
2021-03-07 12:34:15 +01:00