Skip to content

Commit 63c3b90

Browse files
walken-googletorvalds
authored andcommitted
mm: add anon_vma_lock to validate_mm()
Iterating over the vma->anon_vma_chain without anon_vma_lock may cause NULL ptr deref in anon_vma_interval_tree_verify(), because the node in the chain might have been removed. BUG: unable to handle kernel paging request at fffffffffffffff0 IP: [<ffffffff8122c29c>] anon_vma_interval_tree_verify+0xc/0xa0 PGD 4e28067 PUD 4e29067 PMD 0 Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC CPU 0 Pid: 9050, comm: trinity-child64 Tainted: G W 3.7.0-rc2-next-20121025-sasha-00001-g673f98e-dirty #77 RIP: 0010: anon_vma_interval_tree_verify+0xc/0xa0 Process trinity-child64 (pid: 9050, threadinfo ffff880045f80000, task ffff880048eb0000) Call Trace: validate_mm+0x58/0x1e0 vma_adjust+0x635/0x6b0 __split_vma.isra.22+0x161/0x220 split_vma+0x24/0x30 sys_madvise+0x5da/0x7b0 tracesys+0xe1/0xe6 RIP anon_vma_interval_tree_verify+0xc/0xa0 CR2: fffffffffffffff0 Figured out by Bob Liu. Reported-by: Sasha Levin <[email protected]> Cc: Bob Liu <[email protected]> Signed-off-by: Michel Lespinasse <[email protected]> Reviewed-by: Rik van Riel <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
1 parent c5e35d6 commit 63c3b90

File tree

1 file changed

+2
-0
lines changed

1 file changed

+2
-0
lines changed

mm/mmap.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -334,8 +334,10 @@ void validate_mm(struct mm_struct *mm)
334334
struct vm_area_struct *vma = mm->mmap;
335335
while (vma) {
336336
struct anon_vma_chain *avc;
337+
vma_lock_anon_vma(vma);
337338
list_for_each_entry(avc, &vma->anon_vma_chain, same_vma)
338339
anon_vma_interval_tree_verify(avc);
340+
vma_unlock_anon_vma(vma);
339341
vma = vma->vm_next;
340342
i++;
341343
}

0 commit comments

Comments
 (0)