Home Explore Help
Sign In
GfA
/
linux_kernel
5
0
Fork 0
Files Issues 0 Pull Requests 0 Wiki
Browse Source

mm: add anon_vma_lock to validate_mm()

Iterating over the vma->anon_vma_chain without anon_vma_lock may cause
NULL ptr deref in anon_vma_interval_tree_verify(), because the node in the
chain might have been removed.

  BUG: unable to handle kernel paging request at fffffffffffffff0
  IP: [<ffffffff8122c29c>] anon_vma_interval_tree_verify+0xc/0xa0
  PGD 4e28067 PUD 4e29067 PMD 0
  Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
  CPU 0
  Pid: 9050, comm: trinity-child64 Tainted: G        W    3.7.0-rc2-next-20121025-sasha-00001-g673f98e-dirty #77
  RIP: 0010: anon_vma_interval_tree_verify+0xc/0xa0
  Process trinity-child64 (pid: 9050, threadinfo ffff880045f80000, task ffff880048eb0000)
  Call Trace:
    validate_mm+0x58/0x1e0
    vma_adjust+0x635/0x6b0
    __split_vma.isra.22+0x161/0x220
    split_vma+0x24/0x30
    sys_madvise+0x5da/0x7b0
    tracesys+0xe1/0xe6
  RIP  anon_vma_interval_tree_verify+0xc/0xa0
  CR2: fffffffffffffff0

Figured out by Bob Liu.

Reported-by: Sasha Levin <sasha.levin@oracle.com>
Cc: Bob Liu <lliubbo@gmail.com>
Signed-off-by: Michel Lespinasse <walken@google.com>
Reviewed-by: Rik van Riel <riel@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Michel Lespinasse 12 years ago
parent
c5e35d6c51
commit
63c3b902e5
1 changed files with 2 additions and 0 deletions
Unified View Show Diff Stats
  1. 2 0
      mm/mmap.c

+ 2 - 0
mm/mmap.c
View File 

@@ -334,8 +334,10 @@ void validate_mm(struct mm_struct *mm)
 
 	struct vm_area_struct *vma = mm->mmap;
 
 	struct vm_area_struct *vma = mm->mmap;
 
 	while (vma) {
 
 	while (vma) {
 
 		struct anon_vma_chain *avc;
 
 		struct anon_vma_chain *avc;
 
+		vma_lock_anon_vma(vma);
 
 		list_for_each_entry(avc, &vma->anon_vma_chain, same_vma)
 
 		list_for_each_entry(avc, &vma->anon_vma_chain, same_vma)
 
 			anon_vma_interval_tree_verify(avc);
 
 			anon_vma_interval_tree_verify(avc);
 
+		vma_unlock_anon_vma(vma);
 
 		vma = vma->vm_next;
 
 		vma = vma->vm_next;
 
 		i++;
 
 		i++;
 
 	}
 
 	}