linux-kernel - [PATCH] mm/mremap: Fix vma iterator initialization

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Thu, 26 Jan 2023 16:20:11 -0500
From:   "Liam R. Howlett" <Liam.Howlett@...cle.com>
To:     maple-tree@...ts.infradead.org, linux-mm@...ck.org,
        linux-kernel@...r.kernel.org,
        Andrew Morton <akpm@...ux-foundation.org>,
        linux-next@...r.kernel.org
Cc:     "Liam R. Howlett" <Liam.Howlett@...cle.com>,
        Sanan Hasanov <sanan.hasanov@...ghts.ucf.edu>
Subject: [PATCH] mm/mremap: Fix vma iterator initialization

The vma iterator location is incorrect when there is a failure in the
move_vma() function which alters the address being modified.

Delay the initialization of the vma iterator until the address is
stable.

Reported-by: Sanan Hasanov <sanan.hasanov@...ghts.ucf.edu>
Link: https://lore.kernel.org/linux-mm/IA1PR07MB98306BC0F55667A760EABE91ABCE9@IA1PR07MB9830.namprd07.prod.outlook.com/
Signed-off-by: Liam R. Howlett <Liam.Howlett@...cle.com>
---
 mm/mremap.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

Andrew,

This can be placed next to ("mm: change munmap splitting order and
move_vma()") and squashed before sending upstream.

diff --git a/mm/mremap.c b/mm/mremap.c
index 1bc81afd90de..6c7f49ab7d19 100644
--- a/mm/mremap.c
+++ b/mm/mremap.c
@@ -585,7 +585,7 @@ static unsigned long move_vma(struct vm_area_struct *vma,
 	unsigned long hiwater_vm;
 	int err = 0;
 	bool need_rmap_locks;
-	VMA_ITERATOR(vmi, mm, old_addr);
+	struct vma_iterator vmi;
 
 	/*
 	 * We'd prefer to avoid failure later on in do_munmap:
@@ -701,6 +701,7 @@ static unsigned long move_vma(struct vm_area_struct *vma,
 		return new_addr;
 	}
 
+	vma_iter_init(&vmi, mm, old_addr);
 	if (do_vmi_munmap(&vmi, mm, old_addr, old_len, uf_unmap, false) < 0) {
 		/* OOM: unable to split vma, just get accounts right */
 		if (vm_flags & VM_ACCOUNT && !(flags & MREMAP_DONTUNMAP))
-- 
2.39.0