Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.35 as permitted sender) client-ip=23.128.96.35;
From:   "Liam R. Howlett" <Liam.Howlett@oracle.com>
To:     Andrew Morton <akpm@linux-foundation.org>
Cc:     linux-mm@kvack.org, linux-kernel@vger.kernel.org,
        Jann Horn <jannh@google.com>,
        Lorenzo Stoakes <lstoakes@gmail.com>,
        Vlastimil Babka <vbabka@suse.cz>,
        Suren Baghdasaryan <surenb@google.com>,
        Matthew Wilcox <willy@infradead.org>,
        "Liam R. Howlett" <Liam.Howlett@oracle.com>, stable@vger.kernel.org
Subject: [PATCH v3 1/3] mmap: Fix vma_iterator in error path of vma_merge()
Date:   Fri, 29 Sep 2023 14:30:39 -0400
Message-Id: <20230929183041.2835469-2-Liam.Howlett@oracle.com>
In-Reply-To: <20230929183041.2835469-1-Liam.Howlett@oracle.com>
References: <20230929183041.2835469-1-Liam.Howlett@oracle.com>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?dvg0Fdf6I8yeM7DTVCpuxcqCFPcB1FgrmITrf8enQsWpe9aJo8dmiTmJ3cRp?=
 =?us-ascii?Q?l0Z4V89cKsAIRjPaMABlOhP5d0a5XB25wYvvBZ0JcNyxE/y1uJL5YFTj8STe?=
 =?us-ascii?Q?GFcPYjWvulko9Y+lYycNNWEyhWInzrd9Pj8i4r9XAodp6IEIvR58G3myJmOm?=
 =?us-ascii?Q?+LtlsVlqoPjgIXov5Cp0oLvq0OMZAkou0bgdRsh3LNZym4+XpKgjbpIgEI4p?=
 =?us-ascii?Q?ARnv7I8nzecOCiEtCRlXAVJEClefcmL8fBNGf1Oe4nb9A1f7QUN0B/GTA51Q?=
 =?us-ascii?Q?zbUtmgbgpe5V3G1hThfuTGaRN0Z8WTwmfN6sUisgeGDNvLBMn+7s5pcATrhk?=
 =?us-ascii?Q?+mJW0RDl6Ly65TqBbWKKhVtZQDXXgt1eKvcLKKmKjZgqyee7QbgAqJtbyJCm?=
 =?us-ascii?Q?BlWFlsjfE0BaJdfR9UhWEmKTIzinuZ+xX78rPAQ9xKzOVPUGqcMj2PDiKsgS?=
 =?us-ascii?Q?7GmMwEKF0TgRAoI/Uj4RS28dS0XSgV8Vy+Z2DF/NWoG4o+WBku0eNYKlxmOl?=
 =?us-ascii?Q?ZEuIl2qwJRXDJTBrAKwsCrguVgg/LExtFL/wDc9TBMqBchJqPdr6i+8vYCO3?=
 =?us-ascii?Q?Al5dXe2Eyk/V8bWuTq8pjbjfCoSzJADFYb+fQtsvWdG+SC+eUyitnq8dBrmk?=
 =?us-ascii?Q?qGhtV0PSyYph5tPhrY+TNR5Beqlp9Tz0eu9nGkL1SEFdCSAwIXlkIV8reC29?=
 =?us-ascii?Q?twfwaHIkCpzM11ObUxZajLy8fJwPTmts4ciyRNYuJFDAydwsIi6+oaDCoRGU?=
 =?us-ascii?Q?FExq09BQaFA65scLC1yUMWY91eihhZym7MANZ8OVRMKUZAuoHpVdg9zP2LOg?=
 =?us-ascii?Q?oRucJXgQVCepwgH4sfuLCXOnCe5D3YRN1aQnz/97+97VXoVjfblftS2JdgR8?=
 =?us-ascii?Q?WqakpTL8Alw/xXST3jI8duqpRpp1dWdbqP0X+0pHLkAksTifeLdIKDeVDYa7?=
 =?us-ascii?Q?XudeXG0UGlc70y41fbH9WQ/JVDDu3D5Lys1yAM35DZvQ+gQGD7tigeA2ykjI?=
 =?us-ascii?Q?UaAN+XuSVXo0a5S7Y40W5ogzAY80VWdYPULihQoEfnOd1SkgKeLvu4hDUVsy?=
 =?us-ascii?Q?XQPd1ZnYNPKuoakV2qUrKlQciJZi+MpNQKoTGXPOm7lrOSSLts2HDWHHnPSk?=
 =?us-ascii?Q?Rg/y4IZQWX1hLr+lrDSl5zK93QUUcjEOvx5AeWNUmvMmiS13Hq4zJcDniRPI?=
 =?us-ascii?Q?0zJjKPpxCbc9idhwg8MmObSWe5DYKYhd39iIWCg+s57lFGNQK+sGHyE7GWue?=
 =?us-ascii?Q?7YVWb3oUKBGWEWZLca3u31bGdDENf1zskhWlGVllSp3NmLgYv78V4g+4hVkV?=
 =?us-ascii?Q?6/AFD9TjfxgXTn0LA7y4VkRducLoKf26itODHd1l2jYIamfQTRMZ0WYrkVFw?=
 =?us-ascii?Q?LS7coGwalKhS2TxfuKjEWDHN7WkcKldlVr0cwvKqDmjDAyns8WUXKH/GlQRO?=
 =?us-ascii?Q?1AM35Na8PB3oKs2oABd7bhuKGmct1ApgqzY2hoKaHJXLLEpbdTx8UrfEU0R/?=
 =?us-ascii?Q?54PFipGLwEqFIrn/IFOoymmRnzByClGcMsngMtuOxetk0g0mZcTe+N/IlpdJ?=
 =?us-ascii?Q?7e81zxFIJeGeke/8Mg4LJupHcFxeSeYjrxqgzd1d?=
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: =?us-ascii?Q?bPVgEZT8cYWiZGmEYdedrCqVS6FkoreHbalcYzu+TBvCXjMte8jkTdUTJ67W?=
 =?us-ascii?Q?NkD3+TLT7lv/rndZqUq6OO08ZFwLFTep1txwGRmehspONJdMqlgZ4UE1T9gy?=
 =?us-ascii?Q?zlEhWtkQmYuMIuJkz9MOnhTmVQ2nMJIffPCzX1I5BJd/8s56J6aTRpcaa89Q?=
 =?us-ascii?Q?T/77zhfMS5YV90CAb7eKmFGKOAQGdGKft8dHSBZvaqRgu5kUW9viCkujwufE?=
 =?us-ascii?Q?o507L+QBbC1SgOhlZEWM5B18Gw6aWOc4VG0l6NG6GXi6E+QKvzlQmmmlQ6U9?=
 =?us-ascii?Q?3g6uEhCV5RT2YJ18wzu1e/Le3IMAjhHil5ccv6L+Ea74XE/hSRBVgdAyHAWS?=
 =?us-ascii?Q?A/1rT9fgIbR5Ao2ebSu5u3Fg0G3gW/eBOzYjdKV8iwNb3A4r7gS5YXf8WtHM?=
 =?us-ascii?Q?fNnRmZVHoQfyHTjTDcGFpBzRaoeyYp/2aERZjD9lRY415DVO5QIP1ikdUfX4?=
 =?us-ascii?Q?/ChTEETVQhKVcHgw/9VCsxLNaL3KARuy3U1LHg7yaVK16DJZjrqj328uN96H?=
 =?us-ascii?Q?N+qznwMOjgTWRE448IEZ4nJX6yp0XxrDyCNTAwVBGwuHiQXaZXvyGB6QVvIj?=
 =?us-ascii?Q?xoxQPkRcn//98KVlv1XEwC31VayZ6NByE6vlyNE3hbXWXVzHkPqYXZ2du9iM?=
 =?us-ascii?Q?tUzNHSvkbQaGl57MkGWUc9YUPiPQgmrIqZdat4YiFKCfjl8BaAa26vr8mINM?=
 =?us-ascii?Q?64xSyp8vhbhMsI0tjFAIxOh3Yyi8SSVMyAJFBZu42F3TIi/5U1pruvBt4UBP?=
 =?us-ascii?Q?kItU4nO0nutPYpB0/CpqygffAQhj4iFoW6MAy6CE1+dMpPG5bjyBC5TaFwwp?=
 =?us-ascii?Q?Z9XAss0ySWIu0pLN0azJGHqVbzmAh5CIEe5nbgEkc7VTdmBBb9Shu7q/vkGU?=
 =?us-ascii?Q?hQ3OjxNRITUKLzUW5Iz4gqMibNQMya24SrAQoPvTSViet9jrv4RWDqx+GAMH?=
 =?us-ascii?Q?9nb1FnevcA2rRkcyXA9yyw=3D=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 1e6eb506-6251-4d7c-ef45-08dbc11a343c
X-MS-Exchange-CrossTenant-AuthSource: SN6PR10MB3022.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 29 Sep 2023 18:30:50.2985
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: NRJN1lODVj2TDzbeJjsHX0/Qwu9nNjTDQtSmCJ3wlE6DvbjGzFI8zopk1bkK+1YNbGQf/q/BYV/5Q2ttnf7crw==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH0PR10MB7482
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.267,Aquarius:18.0.980,Hydra:6.0.619,FMLib:17.11.176.26
 definitions=2023-09-29_16,2023-09-28_03,2023-05-22_02
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 bulkscore=0 mlxscore=0
 mlxlogscore=819 suspectscore=0 phishscore=0 adultscore=0 malwarescore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2309180000
 definitions=main-2309290160
X-Proofpoint-ORIG-GUID: IVGQmONZVIyrJtu6GdSsP5v7YTlTu1HV
X-Proofpoint-GUID: IVGQmONZVIyrJtu6GdSsP5v7YTlTu1HV
X-Spam-Status: No, score=-0.9 required=5.0 tests=DKIM_SIGNED,DKIM_VALID,
	DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,
	SPF_HELO_NONE,SPF_PASS autolearn=unavailable autolearn_force=no
	version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on groat.vger.email
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org
X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (groat.vger.email [0.0.0.0]); Fri, 29 Sep 2023 11:31:51 -0700 (PDT)

During the error path, the vma iterator may not be correctly positioned
or set to the correct range.  Undo the vma_prev() call by resetting to
the passed in address.  Re-walking to the same range will fix the range
to the area previously passed in.

Users would notice increased cycles as vma_merge() would be called an
extra time with vma == prev, and thus would fail to merge and return.

Link: https://lore.kernel.org/linux-mm/CAG48ez12VN1JAOtTNMY+Y2YnsU45yL5giS-Qn=ejtiHpgJAbdQ@mail.gmail.com/
Closes: https://lore.kernel.org/linux-mm/CAG48ez12VN1JAOtTNMY+Y2YnsU45yL5giS-Qn=ejtiHpgJAbdQ@mail.gmail.com/
Fixes: 18b098af2890 ("vma_merge: set vma iterator to correct position.")
Cc: stable@vger.kernel.org
Cc: Jann Horn <jannh@google.com>
Signed-off-by: Liam R. Howlett <Liam.Howlett@oracle.com>
---
 mm/mmap.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/mm/mmap.c b/mm/mmap.c
index b56a7f0c9f85..acb7dea49e23 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -975,7 +975,7 @@ struct vm_area_struct *vma_merge(struct vma_iterator *vmi, struct mm_struct *mm,
 
 	/* Error in anon_vma clone. */
 	if (err)
-		return NULL;
+		goto anon_vma_fail;
 
 	if (vma_start < vma->vm_start || vma_end > vma->vm_end)
 		vma_expanded = true;
@@ -988,7 +988,7 @@ struct vm_area_struct *vma_merge(struct vma_iterator *vmi, struct mm_struct *mm,
 	}
 
 	if (vma_iter_prealloc(vmi, vma))
-		return NULL;
+		goto prealloc_fail;
 
 	init_multi_vma_prep(&vp, vma, adjust, remove, remove2);
 	VM_WARN_ON(vp.anon_vma && adjust && adjust->anon_vma &&
@@ -1016,6 +1016,12 @@ struct vm_area_struct *vma_merge(struct vma_iterator *vmi, struct mm_struct *mm,
 	vma_complete(&vp, vmi, mm);
 	khugepaged_enter_vma(res, vm_flags);
 	return res;
+
+prealloc_fail:
+anon_vma_fail:
+	vma_iter_set(vmi, addr);
+	vma_iter_load(vmi);
+	return NULL;
 }
 
 /*
-- 
2.40.1