Commit aaf0fba1 authored Aug 24, 2021 by Li Xinhai Committed by Yang Yingliang Aug 24, 2021

mm: rmap: explicitly reset vma->anon_vma in unlink_anon_vmas()

mainline inclusion
from mainline-v5.12-rc1
commit ee8ab190
category: bugfix
bugzilla: 175120
CVE: NA

-------------------------------------------------

In case the vma will continue to be used after unlink its relevant
anon_vma, we need to reset the vma->anon_vma pointer to NULL.  So, later
when fault happen within this vma again, a new anon_vma will be prepared.

By this way, the vma will only be checked for reverse mapping of pages
which been fault in after the unlink_anon_vmas call.

Currently, the mremap with MREMAP_DONTUNMAP scenario will continue use the
vma after moved its page table entries to a new vma.  For other scenarios,
the vma itself will be freed after call unlink_anon_vmas.

Link: https://lkml.kernel.org/r/20210119075126.3513154-1-lixinhai.lxh@gmail.com


Signed-off-by: Li Xinhai <lixinhai.lxh@gmail.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Brian Geffon <bgeffon@google.com>
Cc: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Cc: Lokesh Gidra <lokeshgidra@google.com>
Cc: Minchan Kim <minchan@kernel.org>
Cc: Vlastimil Babka <vbabka@suse.cz>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Signed-off-by: Nanyong Sun <sunnanyong@huawei.com>
Reviewed-by: tong tiangen <tongtiangen@huawei.com>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>

parent bcc10718

mm/rmap.c

+8 −1

Original line number	Diff line number	Diff line
		@@ -406,8 +406,15 @@ void unlink_anon_vmas(struct vm_area_struct *vma)
		list_del(&avc->same_vma);
		anon_vma_chain_free(avc);
		}
		if (vma->anon_vma)
		if (vma->anon_vma) {
		vma->anon_vma->degree--;

		/*
		* vma would still be needed after unlink, and anon_vma will be prepared
		* when handle fault.
		*/
		vma->anon_vma = NULL;
		}
		unlock_anon_vma_root(root);

		/*