mm/rmap: Fix anon_vma->degree ambiguity leading to double-reuse

commit 2555283eb40df89945557273121e9393ef9b542b upstream.

anon_vma->degree tracks the combined number of child anon_vmas and VMAs
that use the anon_vma as their ->anon_vma.

anon_vma_clone() then assumes that for any anon_vma attached to
src->anon_vma_chain other than src->anon_vma, it is impossible for it to
be a leaf node of the VMA tree, meaning that for such VMAs ->degree is
elevated by 1 because of a child anon_vma, meaning that if ->degree
equals 1 there are no VMAs that use the anon_vma as their ->anon_vma.

This assumption is wrong because the ->degree optimization leads to leaf
nodes being abandoned on anon_vma_clone() - an existing anon_vma is
reused and no new parent-child relationship is created.  So it is
possible to reuse an anon_vma for one VMA while it is still tied to
another VMA.

This is an issue because is_mergeable_anon_vma() and its callers assume
that if two VMAs have the same ->anon_vma, the list of anon_vmas
attached to the VMAs is guaranteed to be the same.  When this assumption
is violated, vma_merge() can merge pages into a VMA that is not attached
to the corresponding anon_vma, leading to dangling page->mapping
pointers that will be dereferenced during rmap walks.

Fix it by separately tracking the number of child anon_vmas and the
number of VMAs using the anon_vma as their ->anon_vma.

Fixes: 7a3ef208e662 ("mm: prevent endless growth of anon_vma hierarchy")
Cc: stable@kernel.org
Acked-by: Michal Hocko <mhocko@suse.com>
Acked-by: Vlastimil Babka <vbabka@suse.cz>
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[manually fixed up different indentation in stable]
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/include/linux/rmap.h b/include/linux/rmap.h
index b46bb5620a76d2439a6e0db0a3689c210601c8c3..9dc3617a5bfceaca089715154bd42b8964160f78 100644 (file)
--- a/include/linux/rmap.h
+++ b/include/linux/rmap.h
@@ -37,12 +37,15 @@ struct anon_vma {
        atomic_t refcount;
 
        /*
-        * Count of child anon_vmas and VMAs which points to this anon_vma.
+        * Count of child anon_vmas. Equals to the count of all anon_vmas that
+        * have ->parent pointing to this one, including itself.
         *
         * This counter is used for making decision about reusing anon_vma
         * instead of forking new one. See comments in function anon_vma_clone.
         */
-       unsigned degree;
+       unsigned long num_children;
+       /* Count of VMAs whose ->anon_vma pointer points to this object. */
+       unsigned long num_active_vmas;
 
        struct anon_vma *parent;        /* Parent of this anon_vma */
 

diff --git a/mm/rmap.c b/mm/rmap.c
index 0a5310b76ec8549e17aad0641400aa593e483001..76064d96491863962729ae46367addbf435ee16e 100644 (file)
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -78,7 +78,8 @@ static inline struct anon_vma *anon_vma_alloc(void)
        anon_vma = kmem_cache_alloc(anon_vma_cachep, GFP_KERNEL);
        if (anon_vma) {
                atomic_set(&anon_vma->refcount, 1);
-               anon_vma->degree = 1;   /* Reference for first vma */
+               anon_vma->num_children = 0;
+               anon_vma->num_active_vmas = 0;
                anon_vma->parent = anon_vma;
                /*
                 * Initialise the anon_vma root to point to itself. If called
@@ -187,6 +188,7 @@ int anon_vma_prepare(struct vm_area_struct *vma)
                        anon_vma = anon_vma_alloc();
                        if (unlikely(!anon_vma))
                                goto out_enomem_free_avc;
+                       anon_vma->num_children++; /* self-parent link for new root */
                        allocated = anon_vma;
                }
 
@@ -196,8 +198,7 @@ int anon_vma_prepare(struct vm_area_struct *vma)
                if (likely(!vma->anon_vma)) {
                        vma->anon_vma = anon_vma;
                        anon_vma_chain_link(vma, avc, anon_vma);
-                       /* vma reference or self-parent link for new root */
-                       anon_vma->degree++;
+                       anon_vma->num_active_vmas++;
                        allocated = NULL;
                        avc = NULL;
                }
@@ -276,19 +277,19 @@ int anon_vma_clone(struct vm_area_struct *dst, struct vm_area_struct *src)
                anon_vma_chain_link(dst, avc, anon_vma);
 
                /*
-                * Reuse existing anon_vma if its degree lower than two,
-                * that means it has no vma and only one anon_vma child.
+                * Reuse existing anon_vma if it has no vma and only one
+                * anon_vma child.
                 *
-                * Do not chose parent anon_vma, otherwise first child
-                * will always reuse it. Root anon_vma is never reused:
+                * Root anon_vma is never reused:
                 * it has self-parent reference and at least one child.
                 */
-               if (!dst->anon_vma && anon_vma != src->anon_vma &&
-                               anon_vma->degree < 2)
+               if (!dst->anon_vma &&
+                   anon_vma->num_children < 2 &&
+                   anon_vma->num_active_vmas == 0)
                        dst->anon_vma = anon_vma;
        }
        if (dst->anon_vma)
-               dst->anon_vma->degree++;
+               dst->anon_vma->num_active_vmas++;
        unlock_anon_vma_root(root);
        return 0;
 
@@ -338,6 +339,7 @@ int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma)
        anon_vma = anon_vma_alloc();
        if (!anon_vma)
                goto out_error;
+       anon_vma->num_active_vmas++;
        avc = anon_vma_chain_alloc(GFP_KERNEL);
        if (!avc)
                goto out_error_free_anon_vma;
@@ -358,7 +360,7 @@ int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma)
        vma->anon_vma = anon_vma;
        anon_vma_lock_write(anon_vma);
        anon_vma_chain_link(vma, avc, anon_vma);
-       anon_vma->parent->degree++;
+       anon_vma->parent->num_children++;
        anon_vma_unlock_write(anon_vma);
 
        return 0;
@@ -390,7 +392,7 @@ void unlink_anon_vmas(struct vm_area_struct *vma)
                 * to free them outside the lock.
                 */
                if (RB_EMPTY_ROOT(&anon_vma->rb_root)) {
-                       anon_vma->parent->degree--;
+                       anon_vma->parent->num_children--;
                        continue;
                }
 
@@ -398,7 +400,7 @@ void unlink_anon_vmas(struct vm_area_struct *vma)
                anon_vma_chain_free(avc);
        }
        if (vma->anon_vma)
-               vma->anon_vma->degree--;
+               vma->anon_vma->num_active_vmas--;
        unlock_anon_vma_root(root);
 
        /*
@@ -409,7 +411,8 @@ void unlink_anon_vmas(struct vm_area_struct *vma)
        list_for_each_entry_safe(avc, next, &vma->anon_vma_chain, same_vma) {
                struct anon_vma *anon_vma = avc->anon_vma;
 
-               VM_WARN_ON(anon_vma->degree);
+               VM_WARN_ON(anon_vma->num_children);
+               VM_WARN_ON(anon_vma->num_active_vmas);
                put_anon_vma(anon_vma);
 
                list_del(&avc->same_vma);