Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Liam Howlett <liam.howlett@oracle.com>
To:     "maple-tree@lists.infradead.org" <maple-tree@lists.infradead.org>,
        "linux-mm@kvack.org" <linux-mm@kvack.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        Andrew Morton <akpm@linux-foundation.org>,
        Hugh Dickins <hughd@google.com>
Subject: [PATCH] mm/mmap: Fix locking issues in vma_expand()
Thread-Topic: [PATCH] mm/mmap: Fix locking issues in vma_expand()
Thread-Index: AQHYlf6fdQQFbDqKqEWjS3P5pOojnw==
Date:   Tue, 12 Jul 2022 14:49:43 +0000
Message-ID: <20220712144926.4190769-1-Liam.Howlett@oracle.com>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: =?iso-8859-1?Q?HnPkfv9BAsV3qYkRsqXCNl+w5TLpNIH+WOl6vNI/RkihUAasVSEjFOTts7?=
 =?iso-8859-1?Q?y68B3MvAWg28FaUOqxKv8nQXTMz36jbv42Wp8lA+HYm+LDxodIdUvrm3D8?=
 =?iso-8859-1?Q?key1qg9Ucy3El8Kslm4ARjxf1QY/61WjzgUPt3eD+bpk8N4umJ0ds56PnO?=
 =?iso-8859-1?Q?VIeUxX3ktFTv752RMjURKJHzTZcnZx8cTeSQT9oBjt2UZHQ8uxd0K6dasR?=
 =?iso-8859-1?Q?aNEUTfNTAkfcrc1t4a5IseIwgitpafisnaquHhTGcm3a/z7op6xpTD114B?=
 =?iso-8859-1?Q?CAUFBCXOji0kOD6uesPGhvUHb+fo7F6llMh0RlgOLjxT/XNcKQoDRhbVQ4?=
 =?iso-8859-1?Q?W3oVpZbPhjKvaqMJTUdm48zcmALccu5rUSAEQa0MTeUdoSPpYxLK3+z494?=
 =?iso-8859-1?Q?BjSBN9Cnlrr7z/GrLeRQASXHdJ+UU1XpAMefQM4ZAZond+ItmI3LXV2MRl?=
 =?iso-8859-1?Q?QpxAPS9NYecXyabyzWO7ngt5ZVG3DMuZIn0d0epNGfcX8+tiQph78mZaXG?=
 =?iso-8859-1?Q?ZKnLUwETiDX6VKh42LqqMeR+so0ChYllSmFtyZiSZC8z5RGaIl2RkikaCv?=
 =?iso-8859-1?Q?nT1rxhv1S6dKrwyjyTgZXR4ll+mXEmE58Zjv0y+L8gcyWLVK/zpCDhdqfb?=
 =?iso-8859-1?Q?gjXdz8qhZukBn6S/91KDXanoleY7gcJRQxc9YN0zwSMLLpDikQ3i5IMsIm?=
 =?iso-8859-1?Q?JHaOvKtv80R5U2UO9wJUFOeo9SMmhQ4taiVQ23tFrHSh5YuH/YF5nCg3Wp?=
 =?iso-8859-1?Q?eMrimtxaZhXymUIo5qEPQKcnHJVcvd9WknDz3bKQYBzNIzzxWI6cByVWW/?=
 =?iso-8859-1?Q?Af7dvqdcHvf9en33J6bs7m6nwS73XBCBNm88SG0ASJ7zepPbEiZN5ltHKB?=
 =?iso-8859-1?Q?abtMqnU7NMoCe0fWevUA19w1nGHHHhrpncVAEdzVgFa+50q+q5RLgmVg+B?=
 =?iso-8859-1?Q?4jY1UdQV48FEsR3VDa317ocd6j8WU71dI8rOvKuqUxM4MLtGaKWBLkX33B?=
 =?iso-8859-1?Q?CL2ZQxMxp4r8udgcp7y21GdtpYXz+EbgudQA6RmMmk2Mp3QqAWo0QA+59d?=
 =?iso-8859-1?Q?qCLxUR8MBEL9uPvFMPV0i6hG7SqAXiEi5I99FcEb3953vWsaQp54vM8OIo?=
 =?iso-8859-1?Q?J/W9TVNQBdfy9r6ylyTFFHiTpeAbySo7W9gu0fsGLxf5PU8MiWrrdqb1/o?=
 =?iso-8859-1?Q?6/ozogmuDj0HrUO56+qmdbkH4Yg8nzZ3hnr/xA8AnVXJY6ZQpOayOSQhfE?=
 =?iso-8859-1?Q?fN3Ub+LSIZatokI6Tk7SCkeihdDiv8YhnaIxhLTfvl+YvmIPoBXAv9TLFD?=
 =?iso-8859-1?Q?WWIGaX7XgEypH9cuE7810U1bGvQuhcEpO39zDGpHtv8WrlBAEwll/j22NC?=
 =?iso-8859-1?Q?45huU25ty0Ee9wmVJDfnRgW7yPq82GrPQyAB4uObzY7b4CV2FY+2Ig0qP8?=
 =?iso-8859-1?Q?Cl3azG2q3o1A/ttr5PCzQ4m/FNS+BQrfAiuHDan7LNWuINoBLOmNWyl/ZR?=
 =?iso-8859-1?Q?bpcYnGfIG2PVjrs3jkunelqaLnAKEPE7yS9VZZukooAxMI6+pIL7zrLGaA?=
 =?iso-8859-1?Q?Ax1lx1LJtnvDfgo+zzs2VSgpbbxcTI1GdtdAaQbfq/w4GRKy49Mh7CCd2C?=
 =?iso-8859-1?Q?BXlsBrKXe1m+TNzVmCAEGiWychBez/eRsuosh/rXC+vtgcKxNb8uWe6w?=
 =?iso-8859-1?Q?=3D=3D?=
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: SN6PR10MB3022.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 9323c56c-728f-4daa-9b53-08da6415c1f0
X-MS-Exchange-CrossTenant-originalarrivaltime: 12 Jul 2022 14:49:43.6583
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: hqbBY5SugkU8SjuV2XuQR/Y5ILbVIcq6pxB3/odcn2lv76Lhs/k8YDghnrCTb6T8uOmiAoPCJ6sxbgUpL4Vtwg==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DS0PR10MB6054
X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.517,18.0.883
 definitions=2022-07-12_08:2022-07-12,2022-07-12 signatures=0
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 phishscore=0 mlxlogscore=898
 malwarescore=0 suspectscore=0 mlxscore=0 spamscore=0 adultscore=0
 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2206140000 definitions=main-2207120057
X-Proofpoint-GUID: hVQbHoMgBC6gF2S2JIU14cXGMUaFPsn0
X-Proofpoint-ORIG-GUID: hVQbHoMgBC6gF2S2JIU14cXGMUaFPsn0
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,
        RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_NONE,T_SCC_BODY_TEXT_LINE
        autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Hugh noted that the locking was mixed up in vma_expand(), revert to the
correct order.

Fixes: b2c87578e0ea (mm/mmap: use advanced maple tree API for mmap_region()=
)
Suggested-by: Hugh Dickins <hughd@google.com>
Signed-off-by: Liam R. Howlett <Liam.Howlett@oracle.com>
---
 mm/mmap.c | 23 +++++++++++++----------
 1 file changed, 13 insertions(+), 10 deletions(-)

diff --git a/mm/mmap.c b/mm/mmap.c
index 9eb663cde5c7..9a07bc18e6aa 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -574,7 +574,8 @@ inline int vma_expand(struct ma_state *mas, struct vm_a=
rea_struct *vma,
 		if (next->anon_vma && !vma->anon_vma) {
 			int error;
=20
-			vma->anon_vma =3D next->anon_vma;
+			anon_vma =3D next->anon_vma;
+			vma->anon_vma =3D anon_vma;
 			error =3D anon_vma_clone(vma, next);
 			if (error)
 				return error;
@@ -592,16 +593,19 @@ inline int vma_expand(struct ma_state *mas, struct vm=
_area_struct *vma,
=20
 	vma_adjust_trans_huge(vma, start, end, 0);
=20
+	if (file) {
+		mapping =3D file->f_mapping;
+		root =3D &mapping->i_mmap;
+		uprobe_munmap(vma, vma->vm_start, vma->vm_end);
+		i_mmap_lock_write(mapping);
+	}
+
 	if (anon_vma) {
 		anon_vma_lock_write(anon_vma);
 		anon_vma_interval_tree_pre_update_vma(vma);
 	}
=20
 	if (file) {
-		mapping =3D file->f_mapping;
-		root =3D &mapping->i_mmap;
-		uprobe_munmap(vma, vma->vm_start, vma->vm_end);
-		i_mmap_lock_write(mapping);
 		flush_dcache_mmap_lock(mapping);
 		vma_interval_tree_remove(vma, root);
 	}
@@ -622,16 +626,15 @@ inline int vma_expand(struct ma_state *mas, struct vm=
_area_struct *vma,
 		__remove_shared_vm_struct(next, file, mapping);
 	}
=20
-	if (file) {
-		i_mmap_unlock_write(mapping);
-		uprobe_mmap(vma);
-	}
-
 	if (anon_vma) {
 		anon_vma_interval_tree_post_update_vma(vma);
 		anon_vma_unlock_write(anon_vma);
 	}
=20
+	if (file) {
+		i_mmap_unlock_write(mapping);
+		uprobe_mmap(vma);
+	}
=20
 	if (remove_next) {
 		if (file) {
--=20
2.35.1