Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   "Liam R. Howlett" <Liam.Howlett@oracle.com>
To:     linux-kernel@vger.kernel.org
Cc:     Andrew Morton <akpm@linux-foundation.org>,
        "Liam R. Howlett" <Liam.Howlett@oracle.com>,
        John Hsu <John.Hsu@mediatek.com>, stable@vger.kernel.org,
        linux-mm@kvack.org
Subject: [PATCH stable v6.1] mm/mmap: Fix extra maple tree write
Date:   Thu,  6 Jul 2023 14:51:35 -0400
Message-Id: <20230706185135.2235532-1-Liam.Howlett@oracle.com>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?7/IRNGH6xKn0BwZOhzIYn4TGt66F4q5NIRVpRvG9VkLCZNELR9HixrkVDbO8?=
 =?us-ascii?Q?JYMUPEHcFrKj2pIzZZP0wASQOmJdwaR7Esa6CQzpwXHdUMYehN9KvhCQqaJH?=
 =?us-ascii?Q?iH5/hNoTRGgyHAtqN7ycKcfqGH6Nv0YApMKfvjbcgahJx6T9JfgU0EgUHb4w?=
 =?us-ascii?Q?gT6kyEolbAgkFwkGg6ubFgGmwyWxue1USvhdJuZ/RqNfVS8eTr77SA5cZdbQ?=
 =?us-ascii?Q?TJv3JNQRid07g0Nm8ZqGLLBSlZVphnMysajb9NcBgrggMeymyvW6h8F42QKZ?=
 =?us-ascii?Q?8ueiUxWP+zdMglYzSraVFPzvc8gArE4wx1yUDTVx9KiVI3n9ARJcQO+9vE2G?=
 =?us-ascii?Q?7OavBM+o3zHtDB+0DBZ6BprHEYA59bq2ED2KpCg/DdgZQvVm00Vj0lDUjNh0?=
 =?us-ascii?Q?y2cBOEEqNg41N4JbCpXWTRiMnZWoD8wzWC/GbKJ7ZJAFJomCL0h0RnE8lblt?=
 =?us-ascii?Q?Lf59xje4ytWafAc2rrCV+Pm8IWLSpNpfy+0TygA0rnfi9zawglTgg5unet9I?=
 =?us-ascii?Q?UN7v3M5KCjYBt8ay4TPArlTzSrWFtHlmGL23aPAv6lPzG3PEuD+obT05Ht4J?=
 =?us-ascii?Q?in5U9LMLNHVO1E311ZtWuMz7OpyXll2l3ENAbHkco4qnN919jXDlmITW3t+h?=
 =?us-ascii?Q?NN3oyw5bSU03mq8PxF7vKykuyveNIrfxi+QdM9M8JdZO6+FKACs4WyEDX8xd?=
 =?us-ascii?Q?RuDmRJg/jxfNS6FWSK3X6pBFoGv/WQLTNyftl1+Agk0YELHZkTws7eGguer+?=
 =?us-ascii?Q?UGMRAipFKhG/zvYkUkFBXlYUry0KNWD4aU4BZ0wNeV7R2y6qe2XNu2Iai41Q?=
 =?us-ascii?Q?ooPIIvbGTYupDS1nCxEYH9uBXl8OykczNno2qJ6LqPtr6Ju82YvF6Uw2S9oe?=
 =?us-ascii?Q?ejcLLb1U1lWx1gva1wjrgMvtvhtMXvOJ/Dddq2Xmccls+zA7iuj9wnH12ljn?=
 =?us-ascii?Q?6R6zVRhQiyUJeUFlE2VXijSHtT3WpHkK/gZUPfbIOye6Uttj1HaDzTSzVYEd?=
 =?us-ascii?Q?N6wB7+FJr6kpxBtDEtHlGXf3foam30Rt6HFc3icw5I9WvoTCUB9FZj9JYx10?=
 =?us-ascii?Q?D3fd3/s9LnwU/PJorU6CfFW7vzKehwaoAcO8uh8iQr4KgZE7zqNxZnw3rVUL?=
 =?us-ascii?Q?kV0a6akEhsyPPhPdUpHnMP2bvyXawL7XNtuj676rZmy5W39xQd6RgTSlmlrf?=
 =?us-ascii?Q?Iq4BWO6INnC2D8LRQohqHdYR2OJZ/CAA+vaeCDJwX+lsbzoU2Qo6z69gM1Jr?=
 =?us-ascii?Q?016EzGXCm2jPYUkH9Lwg2zRMANwNYhh3HIu2/s9Pd65JIldpPlb4qMbITodj?=
 =?us-ascii?Q?G0V31Y7+sYrMKDS3JmXPRijTxsdHOPayrXGv11HU7GRP7ORquGg3wqsFkhpe?=
 =?us-ascii?Q?3SlxV8HbvCTZxevfjUy2XuWAW0g6iqC7m2ZELBXjwHIlJwb3VDGndoRQCt4H?=
 =?us-ascii?Q?jhszwOW1PaSATVJR/O3G2ivehdCFYud0Ez1NuxXiVTLenATu23iEHEe8fhMM?=
 =?us-ascii?Q?UjzaH3VHaDzujFIyC9wJqS4QTWmYTcS2lIwi7nVQ/y7LS1KjlO493FwVxTfz?=
 =?us-ascii?Q?yeJ1qTNteNwHRlPsg/pkW9vGmhnEyZ6XkKNEqEObVE3irZQdLsIkPu5pWbbk?=
 =?us-ascii?Q?Wg=3D=3D?=
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: 5solJkWGKsfJJD9j+0cN2+5RhSnelQBk9PHYWA0IGaoAvTArOG73PlvkK6o1RZmq3zZgv3+o8z3jm6WKQ7Yb3ZhjYnE4XYOgtk/qCb55ITXVcgW/9wwmhzH9AL/t3kk6D5aLP898KlsiO8kxb9cokd6uh4T+mEAmI/J+OEhmvqAlcXNxicDwVfDhH56uk/AfInuvFMjphcCTqFIbYTUgIEET7bOFOhGj7FjMBnr/HvEaIpO7YpOmgisZohAKSPk6eyICxsQbtMfVwt7X5W3K2asmpfejOe17SUEYY8/rxVwDxhGxj38vZDGjdXyOep0M0ddWR+gGBe2Hwq5MDND0ilrtomKzF2VkkU0gvK6PKuZeXMgY9mUH/PdY/C3VJvYGG3wk/WKfoKnym3ai5BUpCtXxaFydj6noEnNCzy1+ZJIAB+UFqKI652aUYEOL+gRTxP3xfq7hBUdKwP8zxU0Xbpe4FnK3coxaKTKxNmLG6imMC1f0XGXVq4yG8UHD0vb9ga52vKe6OHvKKlpVZSVKh9XrJVP4wzHF5/5lJNdo5HdbhiFSiVgrm4ZIM9WSnGQzrhos7S862sR+UfInb4VVpcwyETdQwifcLMx9FrDGsnjJf+Vp+ZAbpLKC1hWbWwQ9QI0oZQ0AEPo9R+v4jraehxNBfAFoxuU/VLHjVxee/b/beO2KzLI6zUb21Wa520JxgJYYIBW+BIQn90mm7xan/DsY1fpP0TKarQoV4HAMATjQhOLtPGbYjTOS6h5i3fIrTCcxlIGV9j/DHS4FRsjTwVE8KlCE8dXt66RwDkt8nHGU8HDvX9OXbEUOzpyYBQg4s0E0tpucYp3zPCDcEfQZn/zZ/t3sPVU6tAIbTxK75n+VDW74JocJTi25OoO6xsTG
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 8f062cf8-ce64-4d39-f5f1-08db7e5212d6
X-MS-Exchange-CrossTenant-AuthSource: SN6PR10MB3022.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 06 Jul 2023 18:51:57.2505
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: tmNj+ErAFK1r7eyQkNYDx5xFCH0zdOxEm8MdwXqHrS4KgMCnq1tjx7SaTj37VO6gSS5lYgkdoU0+tsYWglqXKQ==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH0PR10MB4421
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.254,Aquarius:18.0.957,Hydra:6.0.591,FMLib:17.11.176.26
 definitions=2023-07-06_13,2023-07-06_02,2023-05-22_02
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 phishscore=0 mlxlogscore=999
 suspectscore=0 bulkscore=0 spamscore=0 mlxscore=0 adultscore=0
 malwarescore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2305260000 definitions=main-2307060167
X-Proofpoint-ORIG-GUID: iiR-0Eeu7RywGgvZX1AW1JjvVa7ILtBo
X-Proofpoint-GUID: iiR-0Eeu7RywGgvZX1AW1JjvVa7ILtBo
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,
        RCVD_IN_MSPIKE_H5,RCVD_IN_MSPIKE_WL,SPF_HELO_NONE,SPF_NONE,
        T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

commit 0503ea8f5ba73eb3ab13a81c1eefbaf51405385a upstream.

This was inadvertently fixed during the removal of __vma_adjust().

When __vma_adjust() is adjusting next with a negative value (pushing
vma->vm_end lower), there would be two writes to the maple tree.  The
first write is unnecessary and uses all allocated nodes in the maple
state.  The second write is necessary but will need to allocate nodes
since the first write has used the allocated nodes.  This may be a
problem as it may not be safe to allocate at this time, such as a low
memory situation.  Fix the issue by avoiding the first write and only
write the adjusted "next" VMA.

Reported-by: John Hsu <John.Hsu@mediatek.com>
Link: https://lore.kernel.org/lkml/9cb8c599b1d7f9c1c300d1a334d5eb70ec4d7357.camel@mediatek.com/
Cc: stable@vger.kernel.org
Cc: linux-mm@kvack.org
Signed-off-by: Liam R. Howlett <Liam.Howlett@oracle.com>
---
 mm/mmap.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/mm/mmap.c b/mm/mmap.c
index b8af52db3bbe..bb2e0ff0ef61 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -767,7 +767,8 @@ int __vma_adjust(struct vm_area_struct *vma, unsigned long start,
 	}
 	if (end != vma->vm_end) {
 		if (vma->vm_end > end) {
-			if (!insert || (insert->vm_start != end)) {
+			if ((vma->vm_end + adjust_next != end) &&
+			    (!insert || (insert->vm_start != end))) {
 				vma_mas_szero(&mas, end, vma->vm_end);
 				mas_reset(&mas);
 				VM_WARN_ON(insert &&
-- 
2.39.2