Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Liam Howlett <liam.howlett@oracle.com>
To:     "linux-mm@kvack.org" <linux-mm@kvack.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        Andrew Morton <akpm@linux-foundation.org>
CC:     Yu Zhao <yuzhao@google.com>, Jason Donenfeld <Jason@zx2c4.com>,
        Matthew Wilcox <willy@infradead.org>,
        SeongJae Park <sj@kernel.org>,
        Vlastimil Babka <vbabka@suse.cz>,
        Liam Howlett <liam.howlett@oracle.com>,
        Jann Horn <jannh@google.com>
Subject: [PATCH v2] mmap: Fix do_brk_flags() modifying obviously incorrect
 VMAs
Thread-Topic: [PATCH v2] mmap: Fix do_brk_flags() modifying obviously
 incorrect VMAs
Thread-Index: AQHZCN8GtZfVbzYk1k+O68Wup8Rcdg==
Date:   Mon, 5 Dec 2022 19:23:17 +0000
Message-ID: <20221205192304.1957418-1-Liam.Howlett@oracle.com>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: =?iso-8859-1?Q?IfVglh5KekJ2s+bxR6lWV8aueUXrNMp2gVETK4udbYaGmANyOkXx44nVeS?=
 =?iso-8859-1?Q?36H7hwpMHNcj3hczt6QRpzxn4+i4t3VjmNY0cAvIMy0nQoyDtoZRJxww3G?=
 =?iso-8859-1?Q?OFthYXzUcPcWaB18bgTlHsLuHxJ/0livJUkCA9cukIh0wv1pTFRzzXuWBY?=
 =?iso-8859-1?Q?ImAdEBdYqWBzp2jErYrz4LhhG3F29vsrggjIy0oHH4s4Ad6jT+2hRbbvjN?=
 =?iso-8859-1?Q?MohuaQWv1gsEX/E5C/cLjABFQeNuaajl9h47K5VWa5YQAaYJJGYsS64tuq?=
 =?iso-8859-1?Q?QuFs+Eq2sYmoB8WfXtPJFDLAkVeTRBkq0cIQ57660AMQjzIpM6b375MhBp?=
 =?iso-8859-1?Q?l1QCGfd77QO8YjTk0xXbTawT1LqpPTCXNVM2ucSP134iD/NWjih7MRzJHF?=
 =?iso-8859-1?Q?yAzLVb2YxXAvvXA2BmewCukMfkl2StNs77Y73Ter4WT5qlR3OhvEROPGE/?=
 =?iso-8859-1?Q?NfM1pyqy2Xg0cpNpFHFO7+p3VQRwuFwchAx3ao/1CYE5ac5PbsFboVEbmc?=
 =?iso-8859-1?Q?MzK9moDJV6ziSNGh7NiZ2Quh3CNzD2ApXnYWLK/ydFDAq4OV6LtLOP9Ks1?=
 =?iso-8859-1?Q?ve+KzwdSaD2xAvWFLjhM/NFVAWpRpT4dz3/VAezwcEWmFdiomrTUiZ3SV8?=
 =?iso-8859-1?Q?iT7e3EmaWyPN0q3MsM8vkkBuGpQixUv8MvazkpxCiaR7qyr2dErCwI7EB8?=
 =?iso-8859-1?Q?1wk2DhGjHuz7LeVFWs/4x7Um8jCtW09c+dMYcWVpEJBH7JKASMNrJxPnqe?=
 =?iso-8859-1?Q?Dbd8iThkXku4OBUQrOg5qMSJM5S5ugvLFdzi2hJnixdqDx3hF5/B7x//zx?=
 =?iso-8859-1?Q?9oW5MuI2Zepd7jpJefimwnMxmIx1SebtKvxcIAC4Cj5TzXGTBnmRocBHwx?=
 =?iso-8859-1?Q?q0Vu6iMwVR890+q/wvBEXDcO/E2JLgUClz/jjcR2hcSHOXadTVEU/hEvQn?=
 =?iso-8859-1?Q?YmMcfpGNsUMOYGCqwICwPXuJNpDXU0HdW+OsBeQ5vDlO6nX9/FY4Vxbbp6?=
 =?iso-8859-1?Q?XwHkLJVE45WVYdXS/hirCqtsrZsNonJG2weoE5qy5PDgfO1I7VvbSO/24o?=
 =?iso-8859-1?Q?pc2zgrrFX2nUB2TsXAB+/sikHRCoVx0dutgTAyzML/mba3khsNozkmpafa?=
 =?iso-8859-1?Q?V0UHJ5TcdmZJhTx7nuTUfZyHo/mk5zjrvu1nTYLCnBhzAhrxWhMI1jwJds?=
 =?iso-8859-1?Q?0O5Ieoj3AyPAOEy18iYL6K9Nck3QODYtVYk9oe6zizOUuUC1II/UbTNE6W?=
 =?iso-8859-1?Q?Z9YZ1wV+CAR1f3YBf5qeRgb4J/0DFPsRScaKwoy+oof7VviS6HkPsqWIOp?=
 =?iso-8859-1?Q?xO/ivH1L9AX6vQrcdcNqc+uZ0KMcwjrp7nuxxEWFVVstZBdcRbK0xYjFvd?=
 =?iso-8859-1?Q?XYIxNr+MgQxcyvrYz5R5yEVDO97ubP00mTjoupzzeXeVndJHD8KAcwIQJD?=
 =?iso-8859-1?Q?p3rot5vS9LFlLibweyiHY/zj5CTIUG3/E2jdAZRE8gbEjjlBbEhoZlNC4l?=
 =?iso-8859-1?Q?hVFVs6m19EmzBYaNHPGRYf6Jt0Q/t1fEl9/0DsJI/5MD5xcWL0tuAcIMMN?=
 =?iso-8859-1?Q?IxzeA3JpXSCmxx9FO67gaaciNdX78nduFN2RMKjxt0JDBTAhHk3FFKiNyE?=
 =?iso-8859-1?Q?qSc1dZTGYFsZzW5XqdJTl9e5PZflWYBSM+ybYTOeXFHR28j4kgeTtWvQ?=
 =?iso-8859-1?Q?=3D=3D?=
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: =?iso-8859-1?Q?WJbOb9fsrey+oSRNlIjwQEhx1yQr3iqiFpo9JemnYnbKAwMZ3naGDrfldN?=
 =?iso-8859-1?Q?3lZjQ2T8Ox+O4ES8VmycM7oGCUxaSHSDRJbPslWT+A15LQZaQReE96T3S7?=
 =?iso-8859-1?Q?kmfZSYj1k4BshqCbIpXJI+Y6SvPtjGhHqDNqWAT7+sDVK/JNmwfrt422+b?=
 =?iso-8859-1?Q?Oi74vLvOT6PoBAW5ZCStY25I39F1E2Iqof0+ab9zgDjfnNRiK8aVnUnjni?=
 =?iso-8859-1?Q?a6KrUXCkRqGCNFJO/dstATm4tS5rf7lwKBneJnvRs8Mw01v1sxfXmAlxCZ?=
 =?iso-8859-1?Q?Rx++A8pbCKurLHabAMNUCaKY9+MUWPxywMU66hEoZz4TJsgtSbbiq6TjYm?=
 =?iso-8859-1?Q?quNTfYmE8SmGXoTeeigryCi5iO3WR7twmdFlxDOL2WDac3yTHffPJtFPdK?=
 =?iso-8859-1?Q?RCnFHj5G7w6YUwrckXdLZXCV8XETMXxN5Ok5nEPLZStdn64FDU0zDbvVoU?=
 =?iso-8859-1?Q?NKKE7VEYHZ54/RNlZzKoTr9IE46wE7AtVbmAHvQfFSCxmHmIyrAS1Rlw1y?=
 =?iso-8859-1?Q?De2Y0hcLm6gFzbrYiK3fU7/MyVDGAeI5yQeVmPZH0nVICp0DQEikMh06Zo?=
 =?iso-8859-1?Q?x8yp1Uk0kS+OZjAlCKyxCtJp5NwEEPAiKF4dIzJSzL7rFlLFiL+oeuN7QX?=
 =?iso-8859-1?Q?ViOeG1RcFmfDsD5kM/tM63UsolUJUhSu3ap2x9awmVDIrDHcXMjLu6zcwP?=
 =?iso-8859-1?Q?YCBqcGe84e7KDoylE78jlRviqYfq7JSrGsx97V2Law7AQlN9k2lcE2XiFc?=
 =?iso-8859-1?Q?7x85CQAKf3nC8nh1JnbMclWw2VvCVEzAp4+0AKtUnEjYzC+D2Td3geUBuU?=
 =?iso-8859-1?Q?Xzzo4nirbQ/a65wZUivLCBQjgYR9BrJtEH+IuLikSPVgdVm/qUknBPHcw2?=
 =?iso-8859-1?Q?PFWrL3sSHMyg+zkppRXI8st5dUI9bzs7PF8AsGOLQmq5kS6uYIAPNXChqi?=
 =?iso-8859-1?Q?TtCZtTcyaSwk7WYShOqWj8ukkGETMv1QV8SPO6AmYNTr19NSvXvMIq6SSh?=
 =?iso-8859-1?Q?C+lqT6u7XdWK7axdP0oESzqHMSiBTn8vmhzBH8YwPWfFYxml3TlupksNCJ?=
 =?iso-8859-1?Q?9w=3D=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: SN6PR10MB3022.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 076c1486-34b2-48d6-d3f2-08dad6f6297b
X-MS-Exchange-CrossTenant-originalarrivaltime: 05 Dec 2022 19:23:17.2157
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: pojOigLkQzj+SoFfym9gCvj6y+UiDb6yLGSSp3WzOtQgRupECtOiq0BhogAZCe94yna4HphujD/qKqo0NXArJg==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH0PR10MB7008
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.205,Aquarius:18.0.923,Hydra:6.0.545,FMLib:17.11.122.1
 definitions=2022-12-05_01,2022-12-05_01,2022-06-22_01
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 mlxlogscore=895 mlxscore=0
 adultscore=0 phishscore=0 suspectscore=0 malwarescore=0 bulkscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2210170000
 definitions=main-2212050161
X-Proofpoint-GUID: NyFWCVNkvN34xCMQfgjl3xtGTiSTUTSm
X-Proofpoint-ORIG-GUID: NyFWCVNkvN34xCMQfgjl3xtGTiSTUTSm
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,
        RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_NONE autolearn=ham
        autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Add more sanity checks to the VMA that do_brk_flags() will expand.
Ensure the VMA matches basic merge requirements within the function
before calling can_vma_merge_after().

Drop the duplicate checks from vm_brk_flags() since they will be
enforced later.

Fixes: 2e7ce7d354f2 ("mm/mmap: change do_brk_flags() to expand existing VMA=
 and add do_brk_munmap()")
Suggested-by: Jann Horn <jannh@google.com>
Signed-off-by: Liam R. Howlett <Liam.Howlett@oracle.com>
---
 mm/mmap.c | 11 +++--------
 1 file changed, 3 insertions(+), 8 deletions(-)

diff --git a/mm/mmap.c b/mm/mmap.c
index a5eb2f175da0..5d48170fc2b2 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -2946,9 +2946,9 @@ static int do_brk_flags(struct ma_state *mas, struct =
vm_area_struct *vma,
 	 * Expand the existing vma if possible; Note that singular lists do not
 	 * occur after forking, so the expand will only happen on new VMAs.
 	 */
-	if (vma &&
-	    (!vma->anon_vma || list_is_singular(&vma->anon_vma_chain)) &&
-	    ((vma->vm_flags & ~VM_SOFTDIRTY) =3D=3D flags)) {
+	if (vma && vma->vm_end =3D=3D addr && !vma_policy(vma) &&
+	    can_vma_merge_after(vma, flags, NULL, NULL,
+				addr >> PAGE_SHIFT, NULL_VM_UFFD_CTX, NULL)) {
 		mas_set_range(mas, vma->vm_start, addr + len - 1);
 		if (mas_preallocate(mas, vma, GFP_KERNEL))
 			return -ENOMEM;
@@ -3035,11 +3035,6 @@ int vm_brk_flags(unsigned long addr, unsigned long r=
equest, unsigned long flags)
 		goto munmap_failed;
=20
 	vma =3D mas_prev(&mas, 0);
-	if (!vma || vma->vm_end !=3D addr || vma_policy(vma) ||
-	    !can_vma_merge_after(vma, flags, NULL, NULL,
-				 addr >> PAGE_SHIFT, NULL_VM_UFFD_CTX, NULL))
-		vma =3D NULL;
-
 	ret =3D do_brk_flags(&mas, vma, addr, len, flags);
 	populate =3D ((mm->def_flags & VM_LOCKED) !=3D 0);
 	mmap_write_unlock(mm);
--=20
2.35.1