Commit 734537c9 authored by Kirill A. Shutemov's avatar Kirill A. Shutemov Committed by Linus Torvalds

mm: fix use-after-free if memory allocation failed in vma_adjust()

There's one case when vma_adjust() expands the vma, overlapping with
*two* next vma.  See case 6 of mprotect, described in the comment to
vma_merge().

To handle this (and only this) situation we iterate twice over main part
of the function.  See "goto again".

Vegard reported[1] that he sees out-of-bounds access complain from
KASAN, if anon_vma_clone() on the *second* iteration fails.

This happens because we free 'next' vma by the end of first iteration
and don't have a way to undo this if anon_vma_clone() fails on the
second iteration.

The solution is to do all required allocations upfront, before we touch
vmas.

The allocation on the second iteration is only required if first two
vmas don't have anon_vma, but third does.  So we need, in total, one
anon_vma_clone() call.

It's easy to adjust 'exporter' to the third vma for such case.

[1] http://lkml.kernel.org/r/1469514843-23778-1-git-send-email-vegard.nossum@oracle.com

Link: http://lkml.kernel.org/r/1469625255-126641-1-git-send-email-kirill.shutemov@linux.intel.comSigned-off-by: default avatarKirill A. Shutemov <kirill.shutemov@linux.intel.com>
Reported-by: default avatarVegard Nossum <vegard.nossum@oracle.com>
Cc: Rik van Riel <riel@redhat.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent c3491eca
...@@ -621,7 +621,6 @@ int vma_adjust(struct vm_area_struct *vma, unsigned long start, ...@@ -621,7 +621,6 @@ int vma_adjust(struct vm_area_struct *vma, unsigned long start,
{ {
struct mm_struct *mm = vma->vm_mm; struct mm_struct *mm = vma->vm_mm;
struct vm_area_struct *next = vma->vm_next; struct vm_area_struct *next = vma->vm_next;
struct vm_area_struct *importer = NULL;
struct address_space *mapping = NULL; struct address_space *mapping = NULL;
struct rb_root *root = NULL; struct rb_root *root = NULL;
struct anon_vma *anon_vma = NULL; struct anon_vma *anon_vma = NULL;
...@@ -631,17 +630,25 @@ int vma_adjust(struct vm_area_struct *vma, unsigned long start, ...@@ -631,17 +630,25 @@ int vma_adjust(struct vm_area_struct *vma, unsigned long start,
int remove_next = 0; int remove_next = 0;
if (next && !insert) { if (next && !insert) {
struct vm_area_struct *exporter = NULL; struct vm_area_struct *exporter = NULL, *importer = NULL;
if (end >= next->vm_end) { if (end >= next->vm_end) {
/* /*
* vma expands, overlapping all the next, and * vma expands, overlapping all the next, and
* perhaps the one after too (mprotect case 6). * perhaps the one after too (mprotect case 6).
*/ */
again: remove_next = 1 + (end > next->vm_end); remove_next = 1 + (end > next->vm_end);
end = next->vm_end; end = next->vm_end;
exporter = next; exporter = next;
importer = vma; importer = vma;
/*
* If next doesn't have anon_vma, import from vma after
* next, if the vma overlaps with it.
*/
if (remove_next == 2 && next && !next->anon_vma)
exporter = next->vm_next;
} else if (end > next->vm_start) { } else if (end > next->vm_start) {
/* /*
* vma expands, overlapping part of the next: * vma expands, overlapping part of the next:
...@@ -675,7 +682,7 @@ again: remove_next = 1 + (end > next->vm_end); ...@@ -675,7 +682,7 @@ again: remove_next = 1 + (end > next->vm_end);
return error; return error;
} }
} }
again:
vma_adjust_trans_huge(vma, start, end, adjust_next); vma_adjust_trans_huge(vma, start, end, adjust_next);
if (file) { if (file) {
...@@ -796,8 +803,11 @@ again: remove_next = 1 + (end > next->vm_end); ...@@ -796,8 +803,11 @@ again: remove_next = 1 + (end > next->vm_end);
* up the code too much to do both in one go. * up the code too much to do both in one go.
*/ */
next = vma->vm_next; next = vma->vm_next;
if (remove_next == 2) if (remove_next == 2) {
remove_next = 1;
end = next->vm_end;
goto again; goto again;
}
else if (next) else if (next)
vma_gap_update(next); vma_gap_update(next);
else else
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment