Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.37 as permitted sender) client-ip=23.128.96.37;
From:   "Liam R. Howlett" <Liam.Howlett@oracle.com>
To:     Andrew Morton <akpm@linux-foundation.org>
Cc:     maple-tree@lists.infradead.org, linux-mm@kvack.org,
        linux-kernel@vger.kernel.org, Jann Horn <jannh@google.com>,
        Lorenzo Stoakes <lstoakes@gmail.com>,
        Vlastimil Babka <vbabka@suse.cz>,
        Suren Baghdasaryan <surenb@google.com>,
        Matthew Wilcox <willy@infradead.org>,
        "Liam R. Howlett" <Liam.Howlett@oracle.com>, stable@vger.kernel.org
Subject: [PATCH 2/3] mmap: Fix error paths with dup_anon_vma()
Date:   Wed, 27 Sep 2023 12:07:45 -0400
Message-Id: <20230927160746.1928098-3-Liam.Howlett@oracle.com>
In-Reply-To: <20230927160746.1928098-1-Liam.Howlett@oracle.com>
References: <20230927160746.1928098-1-Liam.Howlett@oracle.com>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?BV7LC1OIEumSi1hKnRkz1PhRAibE4SIaUftLhlk0lHmWDEHzHEJct5ki/Yfl?=
 =?us-ascii?Q?GbM4o1R8FnrZ4Wt04DUzh6axla0MvRwrNeyxT9S4HvYiVBiSXWM7Fom9HTOn?=
 =?us-ascii?Q?av8Hl1EaF7dwLO1iBVbqL3uC2Jz5NYd87/lE8dgKjEY8M3iOVT2nlerDQsy2?=
 =?us-ascii?Q?UTP57rSqRUHz+4ua6+VEdInTUZvJNqkFtWcpMcnAGHLodOhankHnpAxfYx0M?=
 =?us-ascii?Q?+e0bFbNzIsVnSCzyOkLysPxMPgJpRa3+ohaC7q2bbc1nOGvLhJSKGStBg9we?=
 =?us-ascii?Q?A1QIir7UmbaN6GIXH3vWMXbozIj4fQt+hJuIt5EDk78QFRG4OtjRMkW5X8xe?=
 =?us-ascii?Q?zyk8035wYAcHNagyOLnB/6LOrEgU2kQ7qUtxB3WCIS6Id88Bbqg9G0aAQprL?=
 =?us-ascii?Q?Bt49aze2yGSSk0xZNx8EC4halohwBmp51widG/xcqIH3y1tJ4s3cP0c3SE11?=
 =?us-ascii?Q?phrKoreOrtZEsvOEiDaIlaY38AFOkcFJmQS83q2Vig5QuuUdwQoI0+EEryoo?=
 =?us-ascii?Q?GSEnRjLiJqxO94o3vnrYInEyEoLgVlDHGw5/4CrSHF1uZOZWOtzYuq+aoWHU?=
 =?us-ascii?Q?gewTtBeHzl8iSXOBzr0koS0tANWV63gwa3wmtoZvYgnicqFCKCg2+poen41Q?=
 =?us-ascii?Q?ixiZEBfRYzUQwkoOHGPJohhwcN6A3hPGOOZCc9nWaLA4HNDBYoWIjeCc6pom?=
 =?us-ascii?Q?BlNoZwWVd290XMhYjvCeECQ7VO9/TJ3lyM5/GqGuXbxSjns/Cz2tTml29Zp+?=
 =?us-ascii?Q?V5njqwlTxo9+dZB+5g/faBkSUgCBAgG/MMiJMXKwKM30PPTd4pmFanhuYi67?=
 =?us-ascii?Q?A2yRM7LDhQvdGPRXY7/LWup+hCm4/XHC7z23VcBFsqP7aru6PURPYjVSFYse?=
 =?us-ascii?Q?dF+e3ndAI9te8ad3U7eH3hXwKyi7cQ1ThFTLy0IxkcKxjdPC+fXrq9pdv5DQ?=
 =?us-ascii?Q?45mGRab4fAamMhMlSpp2UH6ct4XEjfz20hlzL5p6UuWO67TzYx1HDfVj6ZFP?=
 =?us-ascii?Q?OV9iCvHYdWSA+vLKrHCuhSgIV+xz5if8S6kXCEBti0v2VcGCsvGajrrWAJIs?=
 =?us-ascii?Q?zvyFWDIZ3OK3SMh5bM3Gx3nlwouTDhnxR0YpaG7Jy2T4y99Y4oc+tp8jWK6u?=
 =?us-ascii?Q?ISJtVUKhY8MjGx0GEWzJlxhT3WFQc+niIE1kww8Yla7LIMKew69PkNmJJyk0?=
 =?us-ascii?Q?ZBRTkQI6Y9xllEysD5cdu6hHlNvVgDzhjuer26rVHaGwJPgCaoUUxGsVmdWs?=
 =?us-ascii?Q?Oo9XrgMHPC/KDbtD+mgG/s6Ecp7/kBkDLvS//JGBlULhUXuWEbla3tmW7V3g?=
 =?us-ascii?Q?YKFQN8JjGIUAy0ONLmXVa8voDugTOrzhAHjbcUCsaDN3pSpDrKBZD4vfuW09?=
 =?us-ascii?Q?kLkP6FCznDVGV0dDB4+eQuO8j/aRQwdVIJgW3VqqtfwDv88CtdF2QQiSd0QZ?=
 =?us-ascii?Q?w9GiL12PX83sY+MlfXJaHKoZKZKWl8ohD5ifN1k+eM/VqKhlniLnT426rjPt?=
 =?us-ascii?Q?udhPuCUxL115i8g/IFz6WXoyDmpQb/kUjHs1W2m0GTxDQLEDZSZ5LbuytuU1?=
 =?us-ascii?Q?xQbritabVmpLXqmgFsVOpD88ZX1fpq/bOdzz+/hw?=
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: =?us-ascii?Q?/493/iW/yaL+h4zHq5RIUoYfGmGS6JOVUEUlTupYb/uwsRDXe4Oir0gy/maJ?=
 =?us-ascii?Q?TC3XjOvAz7eOM8q93Z/BuTF0SaGy2wn+DhaijyFZ4MCEVhhjPCG8ftdvHIW9?=
 =?us-ascii?Q?ruaGv3IEfx8/G3ImiJHEvKpbxn+tVX98whJDGjfzBy2eIKlyljgeeroDLA1i?=
 =?us-ascii?Q?3Rn0gx5opyYJCMVSCKuI6Mb4KxjJwJarHGOCaFP1yhhgJJ5w7hX7BlJUDmX0?=
 =?us-ascii?Q?sbbyNxoKw+WmxH+G99QLzutI5GDy4y1Od0FDF/u/E0TFMcl++uY+6iJvHcIC?=
 =?us-ascii?Q?EqslfRbOwAIMYq5NAUydyuFNTJdgOKnMQ2cuAMMmZo7qyvuDHPO0shsIn3mO?=
 =?us-ascii?Q?PccLALYCCUjOHh87+13xWJiQLGgk+4qJuROQ2rjVMugrPKrNcqV+6EohxRX3?=
 =?us-ascii?Q?zTJSRYJV4ndHOSeEEbn+QPoiVvzzfRz6G1RpaVOeWdLriQAqArgPLHtx2/Jv?=
 =?us-ascii?Q?3UZBF1YQpNJ9hoKmlmoRBbToDTkrwm/QQQJrD2AMXeFdx9Sprca5WyFnQVLC?=
 =?us-ascii?Q?9biE5XWBt1f6052NWQkZcONscmDL8JGYTCHGBxeHJUNUPOmyrBDURKN8E1T/?=
 =?us-ascii?Q?2eL7+f9eX2sp00ZcVkjxev/TCaU7ojqUMyT1sqEtqTz+4yyOGJxXXteedcsE?=
 =?us-ascii?Q?F9XcuPLPqrb79XHkXRWmPJ6ujP76XHLStWJ4l57YcTWB+0jnE0cAhGcp9FxD?=
 =?us-ascii?Q?ffcDar1huswyfha+6mnDTh/x62s+THGCefBG66FMK65Z/5lK4XUdTb15jEoO?=
 =?us-ascii?Q?HS8MQT4cB1RbaTvoSBt+Xb34wtFsPdL0bBAdohB6Ym4pSghES89OnPKAeAIg?=
 =?us-ascii?Q?K2v1tvnMYkNgWulo/UbbnaGOP1YFo27bI8PCq70fv3oE7abaiiVlVQdCdJYL?=
 =?us-ascii?Q?P9+m4tzWphzil4RI/i/+1oLkrs5tkw5eWu8vtLPxlYDMcuz7clP3LTWMXXa3?=
 =?us-ascii?Q?BsmHbdqFXQc658c74JjDQoILCwT9ZJGUrXaXdqfszd90bxHvDS6oO0fPqmkl?=
 =?us-ascii?Q?7hiI?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 2084138d-d534-42f6-a89c-08dbbf74148e
X-MS-Exchange-CrossTenant-AuthSource: SN6PR10MB3022.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 27 Sep 2023 16:09:08.5998
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: hSK65zzy6aX0ZDPHhnGeXodhWjVC5Q1YVolwB4RN11uSzDXeQwyMY9d4jGlIsBn7C3JY9xnRHfVnYJYHHbWUfA==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: IA1PR10MB6122
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.267,Aquarius:18.0.980,Hydra:6.0.619,FMLib:17.11.176.26
 definitions=2023-09-27_10,2023-09-27_01,2023-05-22_02
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 phishscore=0 bulkscore=0 mlxscore=0
 adultscore=0 mlxlogscore=999 suspectscore=0 malwarescore=0 spamscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2309180000
 definitions=main-2309270137
X-Proofpoint-ORIG-GUID: StTGcNikf1_B-Srv0yNwqwz89SOIiU6d
X-Proofpoint-GUID: StTGcNikf1_B-Srv0yNwqwz89SOIiU6d
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,
        RCVD_IN_MSPIKE_H5,RCVD_IN_MSPIKE_WL,SPF_HELO_NONE,SPF_NONE
        autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org
X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (snail.vger.email [0.0.0.0]); Wed, 27 Sep 2023 09:09:43 -0700 (PDT)

When the calling function fails after the dup_anon_vma(), the
duplication of the anon_vma is not being undone.  Add the necessary
unlink_anon_vma() call to the error paths that are missing them.

This issue showed up during inspection of the error path in vma_merge()
for an unrelated vma iterator issue.

Users may experience increased memory usage, which may be problematic as
the failure would likely be caused by a low memory situation.

Fixes: d4af56c5c7c6 ("mm: start tracking VMAs with maple tree")
Cc: stable@vger.kernel.org
Cc: Jann Horn <jannh@google.com>
Signed-off-by: Liam R. Howlett <Liam.Howlett@oracle.com>
---
 mm/mmap.c | 20 ++++++++++++++------
 1 file changed, 14 insertions(+), 6 deletions(-)

diff --git a/mm/mmap.c b/mm/mmap.c
index b5bc4ca9bdc4..2f0ee489db8a 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -587,7 +587,7 @@ static inline void vma_complete(struct vma_prepare *vp,
  * Returns: 0 on success.
  */
 static inline int dup_anon_vma(struct vm_area_struct *dst,
-			       struct vm_area_struct *src)
+		struct vm_area_struct *src, struct vm_area_struct **dup)
 {
 	/*
 	 * Easily overlooked: when mprotect shifts the boundary, make sure the
@@ -597,6 +597,7 @@ static inline int dup_anon_vma(struct vm_area_struct *dst,
 	if (src->anon_vma && !dst->anon_vma) {
 		vma_assert_write_locked(dst);
 		dst->anon_vma = src->anon_vma;
+		*dup = dst;
 		return anon_vma_clone(dst, src);
 	}
 
@@ -624,6 +625,7 @@ int vma_expand(struct vma_iterator *vmi, struct vm_area_struct *vma,
 	       unsigned long start, unsigned long end, pgoff_t pgoff,
 	       struct vm_area_struct *next)
 {
+	struct vm_area_struct *anon_dup = NULL;
 	bool remove_next = false;
 	struct vma_prepare vp;
 
@@ -633,7 +635,7 @@ int vma_expand(struct vma_iterator *vmi, struct vm_area_struct *vma,
 
 		remove_next = true;
 		vma_start_write(next);
-		ret = dup_anon_vma(vma, next);
+		ret = dup_anon_vma(vma, next, &anon_dup);
 		if (ret)
 			return ret;
 	}
@@ -661,6 +663,8 @@ int vma_expand(struct vma_iterator *vmi, struct vm_area_struct *vma,
 	return 0;
 
 nomem:
+	if (anon_dup)
+		unlink_anon_vmas(anon_dup);
 	return -ENOMEM;
 }
 
@@ -860,6 +864,7 @@ struct vm_area_struct *vma_merge(struct vma_iterator *vmi, struct mm_struct *mm,
 {
 	struct vm_area_struct *curr, *next, *res;
 	struct vm_area_struct *vma, *adjust, *remove, *remove2;
+	struct vm_area_struct *anon_dup = NULL;
 	struct vma_prepare vp;
 	pgoff_t vma_pgoff;
 	int err = 0;
@@ -927,18 +932,18 @@ struct vm_area_struct *vma_merge(struct vma_iterator *vmi, struct mm_struct *mm,
 		vma_start_write(next);
 		remove = next;				/* case 1 */
 		vma_end = next->vm_end;
-		err = dup_anon_vma(prev, next);
+		err = dup_anon_vma(prev, next, &anon_dup);
 		if (curr) {				/* case 6 */
 			vma_start_write(curr);
 			remove = curr;
 			remove2 = next;
 			if (!next->anon_vma)
-				err = dup_anon_vma(prev, curr);
+				err = dup_anon_vma(prev, curr, &anon_dup);
 		}
 	} else if (merge_prev) {			/* case 2 */
 		if (curr) {
 			vma_start_write(curr);
-			err = dup_anon_vma(prev, curr);
+			err = dup_anon_vma(prev, curr, &anon_dup);
 			if (end == curr->vm_end) {	/* case 7 */
 				remove = curr;
 			} else {			/* case 5 */
@@ -954,7 +959,7 @@ struct vm_area_struct *vma_merge(struct vma_iterator *vmi, struct mm_struct *mm,
 			vma_end = addr;
 			adjust = next;
 			adj_start = -(prev->vm_end - addr);
-			err = dup_anon_vma(next, prev);
+			err = dup_anon_vma(next, prev, &anon_dup);
 		} else {
 			/*
 			 * Note that cases 3 and 8 are the ONLY ones where prev
@@ -1018,6 +1023,9 @@ struct vm_area_struct *vma_merge(struct vma_iterator *vmi, struct mm_struct *mm,
 	return res;
 
 prealloc_fail:
+	if (anon_dup)
+		unlink_anon_vmas(anon_dup);
+
 anon_vma_fail:
 	if (merge_prev)
 		vma_next(vmi);
-- 
2.40.1