Skip to content
Commit ba422731 authored by Sean Christopherson's avatar Sean Christopherson Committed by Linus Torvalds
Browse files

mm/mmu_notifier: mm/rmap.c: Fix a mmu_notifier range bug in try_to_unmap_one



The conversion to use a structure for mmu_notifier_invalidate_range_*()
unintentionally changed the usage in try_to_unmap_one() to init the
'struct mmu_notifier_range' with vma->vm_start instead of @address,
i.e. it invalidates the wrong address range.  Revert to the correct
address range.

Manifests as KVM use-after-free WARNINGs and subsequent "BUG: Bad page
state in process X" errors when reclaiming from a KVM guest due to KVM
removing the wrong pages from its own mappings.

Reported-by: default avatar <leozinho29_eu@hotmail.com>
Reported-by: default avatarMike Galbraith <efault@gmx.de>
Reported-and-tested-by: default avatarAdam Borowski <kilobyte@angband.pl>
Reviewed-by: default avatarJérôme Glisse <jglisse@redhat.com>
Reviewed-by: default avatarPankaj gupta <pagupta@redhat.com>
Cc: Christian König <christian.koenig@amd.com>
Cc: Jan Kara <jack@suse.cz>
Cc: Matthew Wilcox <mawilcox@microsoft.com>
Cc: Ross Zwisler <zwisler@kernel.org>
Cc: Dan Williams <dan.j.williams@intel.com>
Cc: Paolo Bonzini ...
parent 4064e47c
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment