lkml.org 
[lkml]   [2022]   [Sep]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.9 30/31] mm/rmap: Fix anon_vma->degree ambiguity leading to double-reuse
    Date
    From: Jann Horn <jannh@google.com>

    commit 2555283eb40df89945557273121e9393ef9b542b upstream.

    anon_vma->degree tracks the combined number of child anon_vmas and VMAs
    that use the anon_vma as their ->anon_vma.

    anon_vma_clone() then assumes that for any anon_vma attached to
    src->anon_vma_chain other than src->anon_vma, it is impossible for it to
    be a leaf node of the VMA tree, meaning that for such VMAs ->degree is
    elevated by 1 because of a child anon_vma, meaning that if ->degree
    equals 1 there are no VMAs that use the anon_vma as their ->anon_vma.

    This assumption is wrong because the ->degree optimization leads to leaf
    nodes being abandoned on anon_vma_clone() - an existing anon_vma is
    reused and no new parent-child relationship is created. So it is
    possible to reuse an anon_vma for one VMA while it is still tied to
    another VMA.

    This is an issue because is_mergeable_anon_vma() and its callers assume
    that if two VMAs have the same ->anon_vma, the list of anon_vmas
    attached to the VMAs is guaranteed to be the same. When this assumption
    is violated, vma_merge() can merge pages into a VMA that is not attached
    to the corresponding anon_vma, leading to dangling page->mapping
    pointers that will be dereferenced during rmap walks.

    Fix it by separately tracking the number of child anon_vmas and the
    number of VMAs using the anon_vma as their ->anon_vma.

    Fixes: 7a3ef208e662 ("mm: prevent endless growth of anon_vma hierarchy")
    Cc: stable@kernel.org
    Acked-by: Michal Hocko <mhocko@suse.com>
    Acked-by: Vlastimil Babka <vbabka@suse.cz>
    Signed-off-by: Jann Horn <jannh@google.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    [manually fixed up different indentation in stable]
    Signed-off-by: Jann Horn <jannh@google.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    include/linux/rmap.h | 7 +++++--
    mm/rmap.c | 31 +++++++++++++++++--------------
    2 files changed, 22 insertions(+), 16 deletions(-)

    --- a/include/linux/rmap.h
    +++ b/include/linux/rmap.h
    @@ -37,12 +37,15 @@ struct anon_vma {
    atomic_t refcount;

    /*
    - * Count of child anon_vmas and VMAs which points to this anon_vma.
    + * Count of child anon_vmas. Equals to the count of all anon_vmas that
    + * have ->parent pointing to this one, including itself.
    *
    * This counter is used for making decision about reusing anon_vma
    * instead of forking new one. See comments in function anon_vma_clone.
    */
    - unsigned degree;
    + unsigned long num_children;
    + /* Count of VMAs whose ->anon_vma pointer points to this object. */
    + unsigned long num_active_vmas;

    struct anon_vma *parent; /* Parent of this anon_vma */

    --- a/mm/rmap.c
    +++ b/mm/rmap.c
    @@ -78,7 +78,8 @@ static inline struct anon_vma *anon_vma_
    anon_vma = kmem_cache_alloc(anon_vma_cachep, GFP_KERNEL);
    if (anon_vma) {
    atomic_set(&anon_vma->refcount, 1);
    - anon_vma->degree = 1; /* Reference for first vma */
    + anon_vma->num_children = 0;
    + anon_vma->num_active_vmas = 0;
    anon_vma->parent = anon_vma;
    /*
    * Initialise the anon_vma root to point to itself. If called
    @@ -187,6 +188,7 @@ int anon_vma_prepare(struct vm_area_stru
    anon_vma = anon_vma_alloc();
    if (unlikely(!anon_vma))
    goto out_enomem_free_avc;
    + anon_vma->num_children++; /* self-parent link for new root */
    allocated = anon_vma;
    }

    @@ -196,8 +198,7 @@ int anon_vma_prepare(struct vm_area_stru
    if (likely(!vma->anon_vma)) {
    vma->anon_vma = anon_vma;
    anon_vma_chain_link(vma, avc, anon_vma);
    - /* vma reference or self-parent link for new root */
    - anon_vma->degree++;
    + anon_vma->num_active_vmas++;
    allocated = NULL;
    avc = NULL;
    }
    @@ -276,19 +277,19 @@ int anon_vma_clone(struct vm_area_struct
    anon_vma_chain_link(dst, avc, anon_vma);

    /*
    - * Reuse existing anon_vma if its degree lower than two,
    - * that means it has no vma and only one anon_vma child.
    + * Reuse existing anon_vma if it has no vma and only one
    + * anon_vma child.
    *
    - * Do not chose parent anon_vma, otherwise first child
    - * will always reuse it. Root anon_vma is never reused:
    + * Root anon_vma is never reused:
    * it has self-parent reference and at least one child.
    */
    - if (!dst->anon_vma && anon_vma != src->anon_vma &&
    - anon_vma->degree < 2)
    + if (!dst->anon_vma &&
    + anon_vma->num_children < 2 &&
    + anon_vma->num_active_vmas == 0)
    dst->anon_vma = anon_vma;
    }
    if (dst->anon_vma)
    - dst->anon_vma->degree++;
    + dst->anon_vma->num_active_vmas++;
    unlock_anon_vma_root(root);
    return 0;

    @@ -338,6 +339,7 @@ int anon_vma_fork(struct vm_area_struct
    anon_vma = anon_vma_alloc();
    if (!anon_vma)
    goto out_error;
    + anon_vma->num_active_vmas++;
    avc = anon_vma_chain_alloc(GFP_KERNEL);
    if (!avc)
    goto out_error_free_anon_vma;
    @@ -358,7 +360,7 @@ int anon_vma_fork(struct vm_area_struct
    vma->anon_vma = anon_vma;
    anon_vma_lock_write(anon_vma);
    anon_vma_chain_link(vma, avc, anon_vma);
    - anon_vma->parent->degree++;
    + anon_vma->parent->num_children++;
    anon_vma_unlock_write(anon_vma);

    return 0;
    @@ -390,7 +392,7 @@ void unlink_anon_vmas(struct vm_area_str
    * to free them outside the lock.
    */
    if (RB_EMPTY_ROOT(&anon_vma->rb_root)) {
    - anon_vma->parent->degree--;
    + anon_vma->parent->num_children--;
    continue;
    }

    @@ -398,7 +400,7 @@ void unlink_anon_vmas(struct vm_area_str
    anon_vma_chain_free(avc);
    }
    if (vma->anon_vma)
    - vma->anon_vma->degree--;
    + vma->anon_vma->num_active_vmas--;
    unlock_anon_vma_root(root);

    /*
    @@ -409,7 +411,8 @@ void unlink_anon_vmas(struct vm_area_str
    list_for_each_entry_safe(avc, next, &vma->anon_vma_chain, same_vma) {
    struct anon_vma *anon_vma = avc->anon_vma;

    - VM_WARN_ON(anon_vma->degree);
    + VM_WARN_ON(anon_vma->num_children);
    + VM_WARN_ON(anon_vma->num_active_vmas);
    put_anon_vma(anon_vma);

    list_del(&avc->same_vma);

    \
     
     \ /
      Last update: 2022-09-02 14:24    [W:2.179 / U:0.164 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site