Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Liam Howlett <liam.howlett@oracle.com>
To:     "maple-tree@lists.infradead.org" <maple-tree@lists.infradead.org>,
        "linux-mm@kvack.org" <linux-mm@kvack.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        Andrew Morton <akpm@linux-foundation.org>
CC:     Linus Torvalds <torvalds@linuxfoundation.org>,
        Liam Howlett <liam.howlett@oracle.com>,
        "syzbot+0d2014e4da2ccced5b41@syzkaller.appspotmail.com" 
        <syzbot+0d2014e4da2ccced5b41@syzkaller.appspotmail.com>
Subject: [PATCH] fs/userfaultfd: Fix maple tree iterator in
 userfaultfd_unregister()
Thread-Topic: [PATCH] fs/userfaultfd: Fix maple tree iterator in
 userfaultfd_unregister()
Thread-Index: AQHY8uUn9z2eFZfR+0CuLW4biB/bkw==
Date:   Mon, 7 Nov 2022 20:11:42 +0000
Message-ID: <20221107201121.1169273-1-Liam.Howlett@oracle.com>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: =?iso-8859-1?Q?0ukvLBKL8k+X1DVuXPhqBqYaL98BNC4Nx3JrxD4g5jsZOfUxvCijNSS9Ky?=
 =?iso-8859-1?Q?ZIesRwgvYOY++tSS3EceznXq1eC5lw7BKJ5nqPSOP6m8m5nSGdBSMt0v2M?=
 =?iso-8859-1?Q?H8JQteFM3rg7BGAeRyZfVXzQ5u+wY4Tg9SYvpbOCRYmmnepvBLxVzBMmZH?=
 =?iso-8859-1?Q?Vw+NW+WKhgCV+I8pSaGsuI0Dfsfj5mJdFqQHwSf2qF3+7IMICRU+p97Hc5?=
 =?iso-8859-1?Q?fqneJA3HTbJ56IA7rImoO9TSZvhaz1650mgdVlCmlmG3ojyV+vtU5RfLgR?=
 =?iso-8859-1?Q?RenzU+eRnweh0nyD8Up4n9wD357zhF0ei6c3FUwdu0V+tDHyPq8f/y0rPG?=
 =?iso-8859-1?Q?KYVP+Gi3243bJZglFlDkI1sbyX0JreJySry49Eg1lgepPwH366B8OXmAqZ?=
 =?iso-8859-1?Q?TJAll51p+sjfoVppFdYKhCCdpdYbAjv93hCD8ZGPr3Dqx4fTJR69Y690vI?=
 =?iso-8859-1?Q?s9dmB+HTCno6L9QU6+B9gvvprA4ezXvwXf1yMQN0/ZxutejcE2DT8/0eYF?=
 =?iso-8859-1?Q?uS+gupazU+jZ0KcpimLRUn26zQWmEJHD8Axj7d/bSNVC5hlSyBYl5U21Da?=
 =?iso-8859-1?Q?TJ7GYCu2pwMxqSacXCW77RmNWAnHaCD8weQjYh3tcl77IJtvmDIcfV3/jT?=
 =?iso-8859-1?Q?2cMo1RITWKXKj3jOn4uDdZ0zrmmiWiFIMi4pS8Ne4hhyu97r9djXIF7JcI?=
 =?iso-8859-1?Q?JYtaQ8+yKOJEJP9bRe0CSEkSsFrBDihenOVM3zBbA2+vzgzIbn0mB022Ov?=
 =?iso-8859-1?Q?26AdeIdMaPeiywicLeQZci0WPnCgwE0LHtJL9ipTWYxHBgXcBlbknF8mDu?=
 =?iso-8859-1?Q?oQ3QZtZVcXmJmZruxOjW5H6ypxcRujlClwf11zhIOU84zXlAWa6BiiAEEO?=
 =?iso-8859-1?Q?Lg62W/WNhyUwDYfMF7MzzAPHZwx/hSsZHdPxp2islD4Z5scNdeEmK3XTb0?=
 =?iso-8859-1?Q?AmQox9NIbBXF1wDXVW6lWuQHFl3QlCWkx3NB3OEpS5mXAcnsOWcmhqThL6?=
 =?iso-8859-1?Q?B8J+urcGprsk/y+BzlD5t2J/HGxZvQ71gY2EqP+KrnMPs6cq7cGj+Phwbw?=
 =?iso-8859-1?Q?b8Tn2ccB/pqFz5VNfUuEWHaXpnFoyjQHkCVGcy/bw3CPt1+oj7ybroJNuQ?=
 =?iso-8859-1?Q?qHdJ4nOapP1vVeoZvdm9x4m6hKoZcKnX/lZhc1elq2eBSRMJsy+PpP7WU2?=
 =?iso-8859-1?Q?TN47Edp/J2cFhK8uLlJ1zYN8y0P9PEKlfNQzQaTnbAglmhLFTh7epitjZR?=
 =?iso-8859-1?Q?8aTNctxOO3gh6qAhWkg7UiHAB6NJFSql9Xlc1rxW7+eDKPuz1B9vhUv7GN?=
 =?iso-8859-1?Q?X/fbMudVFBjg86Bq15ws4JBh5vZePY4gSn5v73vXwh5EjHOeoun9iPZdE3?=
 =?iso-8859-1?Q?CJllSzTD3No8UDP2pZML+MGsmFWLB9f34emF71QFNpxtt1zClJEBX0LTsS?=
 =?iso-8859-1?Q?b+5A97Eb2IWhexgA9wC2rgwgSA/mF5a/Hnw3OVuW6qZvi46pRKZOjiB0+5?=
 =?iso-8859-1?Q?6eDa6C9jOEk1CB9mXNoD+Hvi/tYQY6FDLfxi1fximRKUqy0QVY2S4NFDqP?=
 =?iso-8859-1?Q?ulGMsZweKIzGkQ6O8Irw37N++CVQT7qdZbtVUZ1d8S6Qmo00XmPt49hkdP?=
 =?iso-8859-1?Q?KSuOHkZ9eNmp3vZpM9TyK0PrMJTI51D52cEMWsayeDdKJKDGcXgCG5Lg?=
 =?iso-8859-1?Q?=3D=3D?=
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: SN6PR10MB3022.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: f7139114-7f10-443d-09eb-08dac0fc49d6
X-MS-Exchange-CrossTenant-originalarrivaltime: 07 Nov 2022 20:11:42.8777
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: l1ZiPKhWhd1Xv+TogOjk7mmLyBQMvT47dPfPDz+YpiR5KGekjkya8rHFjSQaivs5fJ9UdcOjtXy4eOvWYHA/8g==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH0PR10MB4806
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.219,Aquarius:18.0.895,Hydra:6.0.545,FMLib:17.11.122.1
 definitions=2022-11-07_11,2022-11-07_02,2022-06-22_01
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 phishscore=0 mlxscore=0 spamscore=0
 adultscore=0 malwarescore=0 mlxlogscore=999 bulkscore=0 suspectscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2210170000
 definitions=main-2211070159
X-Proofpoint-GUID: xwawAvHIIE_oZlBj7kZSKt--9E3Ei_IS
X-Proofpoint-ORIG-GUID: xwawAvHIIE_oZlBj7kZSKt--9E3Ei_IS
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,
        RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_NONE autolearn=ham
        autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

When iterating the VMAs, the maple state needs to be invalidated if the
tree is modified by a split or merge to ensure the maple tree node
contained in the maple state is still valid.  These invalidations were
missed, so add them to the paths which alter the tree.

Reported-by: syzbot+0d2014e4da2ccced5b41@syzkaller.appspotmail.com
Fixes: 69dbe6daf104 (userfaultfd: use maple tree iterator to iterate VMAs)
Signed-off-by: Liam R. Howlett <Liam.Howlett@oracle.com>
---
 fs/userfaultfd.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c
index 091d95ddf9a0..a5ed75271c15 100644
--- a/fs/userfaultfd.c
+++ b/fs/userfaultfd.c
@@ -1630,17 +1630,20 @@ static int userfaultfd_unregister(struct userfaultf=
d_ctx *ctx,
 				 NULL_VM_UFFD_CTX, anon_vma_name(vma));
 		if (prev) {
 			vma =3D prev;
+			mas_pause(&mas);
 			goto next;
 		}
 		if (vma->vm_start < start) {
 			ret =3D split_vma(mm, vma, start, 1);
 			if (ret)
 				break;
+			mas_pause(&mas);
 		}
 		if (vma->vm_end > end) {
 			ret =3D split_vma(mm, vma, end, 0);
 			if (ret)
 				break;
+			mas_pause(&mas);
 		}
 	next:
 		/*
--=20
2.35.1