| Message ID | 20241108222834.3625217-1-thehajime@gmail.com (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | nommu: pass NULL argument to vma_iter_prealloc() | expand |
Andrew, Just in case you didn't notice, this patch was reviewed on another list. Thanks, Liam * Hajime Tazaki <thehajime@gmail.com> [241108 17:29]: > When deleting a vma entry from a maple tree, it has to pass NULL to > vma_iter_prealloc() in order to calculate internal state of the tree, > but it passed a wrong argument. As a result, nommu kernels crashed upon > accessing a vma iterator, such as acct_collect() reading the size of > vma entries after do_munmap(). > > This commit fixes this issue by passing a right argument to the > preallocation call. > > Fixes: b5df09226450 ("mm: set up vma iterator for vma_iter_prealloc() calls") > Cc: stable@vger.kernel.org > Reviewed-by: Liam R. Howlett <Liam.Howlett@Oracle.com> > Signed-off-by: Hajime Tazaki <thehajime@gmail.com> > --- > mm/nommu.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/mm/nommu.c b/mm/nommu.c > index 385b0c15add8..0c708f85408d 100644 > --- a/mm/nommu.c > +++ b/mm/nommu.c > @@ -573,7 +573,7 @@ static int delete_vma_from_mm(struct vm_area_struct *vma) > VMA_ITERATOR(vmi, vma->vm_mm, vma->vm_start); > > vma_iter_config(&vmi, vma->vm_start, vma->vm_end); > - if (vma_iter_prealloc(&vmi, vma)) { > + if (vma_iter_prealloc(&vmi, NULL)) { > pr_warn("Allocation of vma tree for process %d failed\n", > current->pid); > return -ENOMEM; > -- > 2.43.0 >
On Tue, 12 Nov 2024 07:46:18 -0500 "Liam R. Howlett" <Liam.Howlett@oracle.com> wrote: > Andrew, > > Just in case you didn't notice, this patch was reviewed on another list. > > Thanks, > Liam > > * Hajime Tazaki <thehajime@gmail.com> [241108 17:29]: > > When deleting a vma entry from a maple tree, it has to pass NULL to > > vma_iter_prealloc() in order to calculate internal state of the tree, > > but it passed a wrong argument. As a result, nommu kernels crashed upon > > accessing a vma iterator, such as acct_collect() reading the size of > > vma entries after do_munmap(). > > > > This commit fixes this issue by passing a right argument to the > > preallocation call. > > > > Fixes: b5df09226450 ("mm: set up vma iterator for vma_iter_prealloc() calls") > > Cc: stable@vger.kernel.org > > Reviewed-by: Liam R. Howlett <Liam.Howlett@Oracle.com> > > Signed-off-by: Hajime Tazaki <thehajime@gmail.com> Yep, thanks, 247d720b2c5d in mm-hotfixes-stable.
diff --git a/mm/nommu.c b/mm/nommu.c index 385b0c15add8..0c708f85408d 100644 --- a/mm/nommu.c +++ b/mm/nommu.c @@ -573,7 +573,7 @@ static int delete_vma_from_mm(struct vm_area_struct *vma) VMA_ITERATOR(vmi, vma->vm_mm, vma->vm_start); vma_iter_config(&vmi, vma->vm_start, vma->vm_end); - if (vma_iter_prealloc(&vmi, vma)) { + if (vma_iter_prealloc(&vmi, NULL)) { pr_warn("Allocation of vma tree for process %d failed\n", current->pid); return -ENOMEM;
When deleting a vma entry from a maple tree, it has to pass NULL to vma_iter_prealloc() in order to calculate internal state of the tree, but it passed a wrong argument. As a result, nommu kernels crashed upon accessing a vma iterator, such as acct_collect() reading the size of vma entries after do_munmap(). This commit fixes this issue by passing a right argument to the preallocation call. Fixes: b5df09226450 ("mm: set up vma iterator for vma_iter_prealloc() calls") Cc: stable@vger.kernel.org Reviewed-by: Liam R. Howlett <Liam.Howlett@Oracle.com> Signed-off-by: Hajime Tazaki <thehajime@gmail.com> --- mm/nommu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)