From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-3.9 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id F28E5C2BA1A for ; Tue, 7 Apr 2020 03:03:42 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id AE8DF2074F for ; Tue, 7 Apr 2020 03:03:42 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=kernel.org header.i=@kernel.org header.b="HXL9RoL+" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org AE8DF2074F Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=linux-foundation.org Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 5EA6C8E0010; Mon, 6 Apr 2020 23:03:42 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 59C278E0001; Mon, 6 Apr 2020 23:03:42 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 4629C8E0010; Mon, 6 Apr 2020 23:03:42 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0142.hostedemail.com [216.40.44.142]) by kanga.kvack.org (Postfix) with ESMTP id 2EAD88E0001 for ; Mon, 6 Apr 2020 23:03:42 -0400 (EDT) Received: from smtpin25.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay01.hostedemail.com (Postfix) with ESMTP id EAF6D180AD806 for ; Tue, 7 Apr 2020 03:03:41 +0000 (UTC) X-FDA: 76679563842.25.shoe45_5a7486624ed33 X-HE-Tag: shoe45_5a7486624ed33 X-Filterd-Recvd-Size: 2836 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by imf39.hostedemail.com (Postfix) with ESMTP for ; Tue, 7 Apr 2020 03:03:41 +0000 (UTC) Received: from localhost.localdomain (c-73-231-172-41.hsd1.ca.comcast.net [73.231.172.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 4336E20801; Tue, 7 Apr 2020 03:03:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1586228620; bh=CzXEXSZEAkIMPYvB2UE4647Xphc+gZg9tl4Ybqwt5OI=; h=Date:From:To:Subject:In-Reply-To:From; b=HXL9RoL+wQVFeEbDa5yhIlAK4coLBxUy/O8de0IGgcHvC2j3qYoLhRrcRFPOZyc2G 6m7gtW2G3H6P4Wpiv/RVC+v4b8CHDLbDE/f572Fsjc3ysfjt6c+WTSz93bgN+4nj4A EKr+yQOs7OEPgpu+gQ+fUDcvwn6Ea34jv7J3ZirM= Date: Mon, 06 Apr 2020 20:03:39 -0700 From: Andrew Morton To: akpm@linux-foundation.org, hannes@cmpxchg.org, kirill.shutemov@linux.intel.com, linux-mm@kvack.org, lixinhai.lxh@gmail.com, mm-commits@vger.kernel.org, riel@redhat.com, torvalds@linux-foundation.org, willy@infradead.org Subject: [patch 004/166] mm: set vm_next and vm_prev to NULL in vm_area_dup() Message-ID: <20200407030339.s4peScfXi%akpm@linux-foundation.org> In-Reply-To: <20200406200254.a69ebd9e08c4074e41ddebaf@linux-foundation.org> User-Agent: s-nail v14.8.16 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: From: Li Xinhai Subject: mm: set vm_next and vm_prev to NULL in vm_area_dup() Set ->vm_next and ->vm_prev to NULL to prevent potential misuse from the new duplicated vma. Currently, only in fork path there are misuse for handling anon_vma. No other bugs been revealed with this patch applied. Link: http://lkml.kernel.org/r/1581150928-3214-4-git-send-email-lixinhai.lxh@gmail.com Signed-off-by: Li Xinhai Acked-by: Kirill A. Shutemov Cc: Matthew Wilcox Cc: Johannes Weiner Cc: Rik van Riel Signed-off-by: Andrew Morton --- kernel/fork.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/kernel/fork.c~mm-set-vm_next-and-vm_prev-to-null-in-vm_area_dup +++ a/kernel/fork.c @@ -361,6 +361,7 @@ struct vm_area_struct *vm_area_dup(struc if (new) { *new = *orig; INIT_LIST_HEAD(&new->anon_vma_chain); + new->vm_next = new->vm_prev = NULL; } return new; } @@ -562,7 +563,6 @@ static __latent_entropy int dup_mmap(str } else if (anon_vma_fork(tmp, mpnt)) goto fail_nomem_anon_vma_fork; tmp->vm_flags &= ~(VM_LOCKED | VM_LOCKONFAULT); - tmp->vm_next = tmp->vm_prev = NULL; file = tmp->vm_file; if (file) { struct inode *inode = file_inode(file); _