Jann Horn 98f401d363 mm/rmap: Fix anon_vma->degree ambiguity leading to double-reuse ... commit 2555283eb4 upstream. anon_vma->degree tracks the combined number of child anon_vmas and VMAs that use the anon_vma as their ->anon_vma. anon_vma_clone() then assumes that for any anon_vma attached to src->anon_vma_chain other than src->anon_vma, it is impossible for it to be a leaf node of the VMA tree, meaning that for such VMAs ->degree is elevated by 1 because of a child anon_vma, meaning that if ->degree equals 1 there are no VMAs that use the anon_vma as their ->anon_vma. This assumption is wrong because the ->degree optimization leads to leaf nodes being abandoned on anon_vma_clone() - an existing anon_vma is reused and no new parent-child relationship is created. So it is possible to reuse an anon_vma for one VMA while it is still tied to another VMA. This is an issue because is_mergeable_anon_vma() and its callers assume that if two VMAs have the same ->anon_vma, the list of anon_vmas attached to the VMAs is guaranteed to be the same. When this assumption is violated, vma_merge() can merge pages into a VMA that is not attached to the corresponding anon_vma, leading to dangling page->mapping pointers that will be dereferenced during rmap walks. Fix it by separately tracking the number of child anon_vmas and the number of VMAs using the anon_vma as their ->anon_vma. Fixes: 7a3ef208e6 ("mm: prevent endless growth of anon_vma hierarchy") Cc: stable@kernel.org Acked-by: Michal Hocko <mhocko@suse.com> Acked-by: Vlastimil Babka <vbabka@suse.cz> Signed-off-by: Jann Horn <jannh@google.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2022-09-05 10:28:56 +02:00
..
kasan	kasan: prevent cpu_quarantine corruption when CPU offline and cache shrink occur at same time	2022-05-09 09:05:07 +02:00
backing-dev.c	mm: bdi: initialize bdi_min_ratio when bdi is unregistered	2021-12-14 11:32:37 +01:00
balloon_compaction.c
cleancache.c
cma.c
cma.h
cma_debug.c
compaction.c	mm, compaction: fast_find_migrateblock() should return pfn in the target zone	2022-06-09 10:21:23 +02:00
debug.c	mm, dump_page: rename head_mapcount() --> head_compound_mapcount()	2020-10-13 18:38:29 -07:00
debug_page_ref.c
debug_vm_pgtable.c	mm/debug_vm_pgtable: remove pte entry from the page table	2022-02-08 18:30:35 +01:00
dmapool.c	mm/dmapool.c: replace hard coded function name with __func__	2020-10-13 18:38:32 -07:00
early_ioremap.c
fadvise.c	mm, fadvise: improve the expensive remote LRU cache draining after FADV_DONTNEED	2020-10-13 18:38:29 -07:00
failslab.c
filemap.c	mm/filemap: add missing mem_cgroup_uncharge() to __add_to_page_cache_locked()	2021-02-10 09:29:21 +01:00
frame_vector.c
frontswap.c
gup.c	mm/gup: fix try_grab_compound_head() race with split_huge_page()	2021-07-14 16:55:42 +02:00
gup_benchmark.c	mm/gup_benchmark: take the mmap lock around GUP	2020-10-18 09:27:09 -07:00
highmem.c	mm/highmem.c: clean up endif comments	2020-10-16 11:11:18 -07:00
hmm.c	mm/hmm.c: allow VM_MIXEDMAP to work with hmm_range_fault	2022-01-27 10:54:36 +01:00
huge_memory.c	mm/huge_memory.c: use helper function migration_entry_to_page()	2022-08-31 17:15:16 +02:00
hugetlb.c	hugetlb: fix huge_pmd_unshare address update	2022-06-09 10:21:27 +02:00
hugetlb_cgroup.c	hugetlb_cgroup: fix imbalanced css_get and css_put pair for shared mappings	2021-03-30 14:31:54 +02:00
hwpoison-inject.c	mm,hwpoison-inject: don't pin for hwpoison_filter	2020-10-16 11:11:16 -07:00
init-mm.c	mm/gup: prevent gup_fast from racing with COW during fork	2020-12-30 11:53:54 +01:00
internal.h	mm/thp: fix vma_address() if virtual address below file offset	2021-06-30 08:47:27 -04:00
interval_tree.c
ioremap.c
Kconfig	mm/zsmalloc.c: drop ZSMALLOC_PGTABLE_MAPPING	2020-12-06 10:19:07 -08:00
Kconfig.debug
khugepaged.c	mm: khugepaged: skip huge page collapse for special files	2021-11-06 14:10:09 +01:00
kmemleak.c	mm: kmemleak: take a full lowmem check in kmemleak_*_phys()	2022-04-20 09:23:25 +02:00
ksm.c	ksm: fix potential missing rmap_item for stable_node	2021-05-19 10:13:07 +02:00
list_lru.c	mm: list_lru: set shrinker map bit when child nr_items is not zero	2020-12-06 10:19:07 -08:00
maccess.c
madvise.c	Revert "mm: madvise: skip unmapped vma holes passed to process_madvise"	2022-04-08 14:39:54 +02:00
Makefile	mm,kmemleak-test.c: move kmemleak-test.c to samples dir	2020-10-13 18:38:27 -07:00
mapping_dirty_helpers.c
memblock.c	memblock: use kfree() to release kmalloced memblock regions	2022-03-02 11:42:57 +01:00
memcontrol.c	mm/memcontrol: return 1 from cgroup.memory __setup() handler	2022-04-08 14:40:43 +02:00
memfd.c	memfd: fix F_SEAL_WRITE after shmem huge page allocated	2022-03-08 19:09:36 +01:00
memory-failure.c	mm/hwpoison: clear MF_COUNT_INCREASED before retrying get_any_page()	2021-12-29 12:26:05 +01:00
memory.c	mm: split huge PUD on wp_huge_pud fallback	2022-07-21 21:19:59 +02:00
memory_hotplug.c	mm/memory_hotplug: use "unsigned long" for PFN in zone_for_pfn_range()	2021-09-22 12:27:59 +02:00
mempolicy.c	mm/mempolicy: fix uninit-value in mpol_rebind_policy()	2022-07-29 17:19:23 +02:00
mempool.c	mm/mempool: add 'else' to split mutually exclusive case	2020-10-13 18:38:34 -07:00
memremap.c	mm: fix memory_failure() handling of dax-namespace metadata	2021-03-04 11:38:21 +01:00
memtest.c
migrate.c	mm: fix missing cache flush for all tail pages of compound page	2022-05-15 20:00:09 +02:00
mincore.c	mm: factor find_get_incore_page out of mincore_page	2020-10-13 18:38:29 -07:00
mlock.c
mm_init.c
mmap.c	mm: Force TLB flush for PFNMAP mappings before unlink_file_vma()	2022-09-05 10:28:54 +02:00
mmu_gather.c
mmu_notifier.c	mm/mmu_notifier.c: fix race in mmu_interval_notifier_remove()	2022-04-27 13:53:54 +02:00
mmzone.c	arm: remove CONFIG_ARCH_HAS_HOLES_MEMORYMODEL	2022-05-15 20:00:09 +02:00
mprotect.c	mm: don't try to NUMA-migrate COW pages that have other uses	2022-02-23 12:00:57 +01:00
mremap.c	mm/mremap: hold the rmap lock in write mode when moving page table entries.	2022-08-21 15:15:21 +02:00
msync.c
nommu.c	mm: remove alloc_vm_area	2020-10-18 09:27:10 -07:00
oom_kill.c	oom_kill.c: futex: delay the OOM reaper to allow time for proper futex cleanup	2022-04-27 13:53:54 +02:00
page-writeback.c	mm: make wait_on_page_writeback() wait for multiple pending writebacks	2021-01-12 20:18:22 +01:00
page_alloc.c	page_alloc: fix invalid watermark check on a negative value	2022-08-03 12:00:50 +02:00
page_counter.c	mm/page_counter: correct the obsolete func name in the comment of page_counter_try_charge()	2020-10-13 18:38:30 -07:00
page_ext.c
page_idle.c
page_io.c	mm: fix unexpected zeroed page mapping with zram swap	2022-04-20 09:23:25 +02:00
page_isolation.c	mm: rename page_order() to buddy_order()	2020-10-16 11:11:19 -07:00
page_owner.c	mm: rename page_order() to buddy_order()	2020-10-16 11:11:19 -07:00
page_poison.c	mm/page_poison.c: replace bool variable with static key	2020-10-16 11:11:17 -07:00
page_reporting.c	mm: rename page_order() to buddy_order()	2020-10-16 11:11:19 -07:00
page_reporting.h
page_vma_mapped.c	mm/thp: another PVMW_SYNC fix in page_vma_mapped_walk()	2021-06-30 08:47:29 -04:00
pagewalk.c
percpu-internal.h	percpu: make pcpu_nr_empty_pop_pages per chunk type	2021-04-14 08:42:03 +02:00
percpu-km.c
percpu-stats.c	percpu: make pcpu_nr_empty_pop_pages per chunk type	2021-04-14 08:42:03 +02:00
percpu-vm.c
percpu.c	percpu: make pcpu_nr_empty_pop_pages per chunk type	2021-04-14 08:42:03 +02:00
pgalloc-track.h
pgtable-generic.c	mm/thp: fix __split_huge_pmd_locked() on shmem migration entry	2021-06-30 08:47:26 -04:00
process_vm_access.c	mm/process_vm_access.c: include compat.h	2021-01-19 18:27:21 +01:00
ptdump.c	mm: ptdump: fix build failure	2021-04-21 13:00:57 +02:00
readahead.c	mm: use limited read-ahead to satisfy read	2020-10-17 13:49:08 -06:00
rmap.c	mm/rmap: Fix anon_vma->degree ambiguity leading to double-reuse	2022-09-05 10:28:56 +02:00
rodata_test.c
shmem.c	shmem: fix a race between shmem_unused_huge_shrink and shmem_evict_inode	2022-01-27 10:53:44 +01:00
shuffle.c	mm: rename page_order() to buddy_order()	2020-10-16 11:11:19 -07:00
shuffle.h
slab.c	mm/sl?b.c: remove ctor argument from kmem_cache_flags	2021-05-14 09:50:45 +02:00
slab.h	mm: kmemleak: slob: respect SLAB_NOLEAKTRACE flag	2021-11-26 10:39:19 +01:00
slab_common.c	mm/slub: fix redzoning for small allocations	2021-06-23 14:42:54 +02:00
slob.c
slub.c	mm/slub: add missing TID updates on slab deactivation	2022-07-12 16:32:16 +02:00
sparse-vmemmap.c
sparse.c	mm/sparse: add the missing sparse_buffer_fini() in error branch	2021-05-14 09:50:45 +02:00
swap.c	mm: move call to compound_head() in release_pages()	2020-10-13 18:38:33 -07:00
swap_cgroup.c
swap_slots.c	mm/swap_slots.c: remove always zero and unused return value of enable_swap_slots_cache()	2020-10-13 18:38:30 -07:00
swap_state.c	mm: swap: get rid of livelock in swapin readahead	2022-03-23 09:13:27 +01:00
swapfile.c	mm/swap: fix pte_same_as_swp() not removing uffd-wp bit when compare	2021-06-23 14:42:53 +02:00
truncate.c	mm/thp: unmap_mapping_page() to fix THP truncate_cleanup_page()	2021-06-30 08:47:27 -04:00
usercopy.c	mm/usercopy: return 1 from hardened_usercopy __setup() handler	2022-04-08 14:40:43 +02:00
userfaultfd.c	mm: userfaultfd: fix missing cache flush in mcopy_atomic_pte() and __mcopy_atomic()	2022-05-15 20:00:09 +02:00
util.c	mm: Add kvrealloc()	2022-08-21 15:15:21 +02:00
vmacache.c
vmalloc.c	mm/vmalloc.c: fix potential memory leak	2021-01-19 18:27:21 +01:00
vmpressure.c
vmscan.c	mm,vmscan: fix divide by zero in get_scan_count	2021-09-18 13:40:36 +02:00
vmstat.c	arm: remove CONFIG_ARCH_HAS_HOLES_MEMORYMODEL	2022-05-15 20:00:09 +02:00
workingset.c	XArray updates for 5.9	2020-10-20 14:39:37 -07:00
z3fold.c	mm/z3fold: use release_z3fold_page_locked() to release locked z3fold page	2021-07-14 16:56:51 +02:00
zbud.c	mm/zbud: remove redundant initialization	2020-10-13 18:38:34 -07:00
zpool.c
zsmalloc.c	zsmalloc: fix races between asynchronous zspage free and page migration	2022-06-06 08:42:43 +02:00
zswap.c