linux-kernel - [PATCH] mm/madvise: Fix VMA

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20230125135809.85262-1-Liam.Howlett@oracle.com>
Date:   Wed, 25 Jan 2023 08:58:09 -0500
From:   "Liam R. Howlett" <Liam.Howlett@...cle.com>
To:     maple-tree@...ts.infradead.org, linux-mm@...ck.org,
        linux-kernel@...r.kernel.org,
        Andrew Morton <akpm@...ux-foundation.org>,
        linux-next@...r.kernel.org
Cc:     Liam Howlett <Liam.Howlett@...cle.com>,
        syzbot+1d9ec4d1a334ae9e1ca6@...kaller.appspotmail.com
Subject: [PATCH] mm/madvise: Fix VMA_ITERATOR start position

From: Liam Howlett <Liam.Howlett@...cle.com>

The WARN_ON() in vma_iter_store() detected an invalid VMA iterator
state.  Inspecting the code stack from the report shows that the VMA
iterator is never set to the correct start position.

Setting the initialization of the VMA iterator to use the address
'start' fixes this issue.

Reported-by: syzbot+1d9ec4d1a334ae9e1ca6@...kaller.appspotmail.com
Signed-off-by: Liam Howlett <Liam.Howlett@...cle.com>
---

Andrew, this can be squashed into the mm-unstable ("madvise: use
split_vma() instead of __split_vma()")


 mm/madvise.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mm/madvise.c b/mm/madvise.c
index 7db6622f8293..ca672e37b38c 100644
--- a/mm/madvise.c
+++ b/mm/madvise.c
@@ -142,7 +142,7 @@ static int madvise_update_vma(struct vm_area_struct *vma,
 	struct mm_struct *mm = vma->vm_mm;
 	int error;
 	pgoff_t pgoff;
-	VMA_ITERATOR(vmi, mm, 0);
+	VMA_ITERATOR(vmi, mm, start);
 
 	if (new_flags == vma->vm_flags && anon_vma_name_eq(anon_vma_name(vma), anon_name)) {
 		*prev = vma;
-- 
2.39.0