Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:4 as permitted sender) client-ip=2620:137:e000::3:4;
From:   "Liam R. Howlett" <Liam.Howlett@oracle.com>
To:     Andrew Morton <akpm@linux-foundation.org>
Cc:     maple-tree@lists.infradead.org, linux-mm@kvack.org,
        linux-kernel@vger.kernel.org, Jann Horn <jannh@google.com>,
        Lorenzo Stoakes <lstoakes@gmail.com>,
        Vlastimil Babka <vbabka@suse.cz>,
        Suren Baghdasaryan <surenb@google.com>,
        Matthew Wilcox <willy@infradead.org>, stable@vger.kernel.org,
        "Liam R. Howlett" <Liam.Howlett@oracle.com>
Subject: [PATCH v2 1/3] mmap: Fix vma_iterator in error path of vma_merge()
Date:   Thu, 28 Sep 2023 13:16:32 -0400
Message-Id: <20230928171634.2245042-2-Liam.Howlett@oracle.com>
In-Reply-To: <20230928171634.2245042-1-Liam.Howlett@oracle.com>
References: <20230928171634.2245042-1-Liam.Howlett@oracle.com>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?mCR+/hYEbY9gYr27tLfB3+CpQPKTwDCA9PevFZOR7V8NdV/EdXVijYN81il/?=
 =?us-ascii?Q?DhsKcWxxcHKivvTlDZgK4yILlRBg9+r9LOSm9JhO+BH0W8cBLbOrAsL+RaWr?=
 =?us-ascii?Q?RMHbIRDb+zPcz0QN+JeiZyOi3FiQSZMi5vUZMuTQQe2y/4Oy7qYgQfWWdrpn?=
 =?us-ascii?Q?3uy1JtBBuqKGE3/HD0eeMr7ayXSDI/FerosXSqNJs77khYkC/LlmxtUcSyuZ?=
 =?us-ascii?Q?26eTbzm+d0ugp7OHc5UUWpGLz59LM9SGFpbEFjmqyhGKjKrij1CL5mn/ln5f?=
 =?us-ascii?Q?Drx4uuuQFFLVoV8ZUJCeE4cAjJyFBhFiaw/oEJ53HbjHrGRPXv/i+hNgi4+9?=
 =?us-ascii?Q?nB68Yc2M2+fIPmk3KIuAku60nCjDvl7+17M9dHUrzQLY+c7goH8w1K0DjKCn?=
 =?us-ascii?Q?jPYYQbu9FlOR0Vpgab9UTmrboTOtkANJqGdvu5MYOGVeUkcHQusSOPZDpSyq?=
 =?us-ascii?Q?ZomsBCCod7ijvnd2AtSJQ/bunJhp6cAz5xDbtTUmnrHKtipOFYDFGyKxHQRz?=
 =?us-ascii?Q?2w5M6v0lp6VYwcvf2IJYOPffzotOR9i7RX9kSbyFgkgOC3X7ExEyJlSUCZXz?=
 =?us-ascii?Q?C60ysc6kK+YiTLSudum42HltQZyiN2T6FSSelb7xjGNhGrYgiMh89JCNJdwc?=
 =?us-ascii?Q?C4lXBWL7PFV+NySel4P08lIBOeyZdTqr60kttrHrUICMurWhhpPQqT4KHYqo?=
 =?us-ascii?Q?exRKrBqBEpsE0cl4IF+a6EJQRZqgJdYd84VA/fA0fKjWGlm5sBU7oapAHgqu?=
 =?us-ascii?Q?zWmczaMA91AOWr8iopwo7lR6oLHwVltXJ05tUS9w/+Xt4EXc5H32r6mH3PkO?=
 =?us-ascii?Q?++OZzfSC8Wf7PIMXm+QC/uWKRGbJweFaLeBKHF/PqltUi6OyOl14BThLQRMh?=
 =?us-ascii?Q?UZ1SkY7I5v7g6i93zn/oFyHeYiO6E5x9xY/4d/YSPNBDB9PHW6KLybmWJ8NG?=
 =?us-ascii?Q?a8WTGmxeDkTZFD4I9JAAfTDkcvxT50NQqldYDUZ0ZNlLxSsoiAK4Bv5phHx6?=
 =?us-ascii?Q?FtmpR69UeSQ6JWsUCuxILZJWsjl6/OevvWedg1H7PjPLp0tiblImGqPKS9Al?=
 =?us-ascii?Q?b48VhRlAKevxbaSj81czu7GoMKkoQqOdxGhMgq5JdfEnLGAXLjHbOauCsCKo?=
 =?us-ascii?Q?3UXv7pbwMrirh+ud1nwrp51NWzmFtGfo9Lu4hYb6nDz0XgaaTp6biJhb0W9p?=
 =?us-ascii?Q?W+C4D7ewQW3abJDfiqYcVl2jxJXZa6Op8H86hthwQEM7NeldIQF8rwr9x+/m?=
 =?us-ascii?Q?4JH1U6FqQuvfHsETv9uvkOKK1kCF5CW+bbunuFXDkLkQkXtuBWChoMAeoB+g?=
 =?us-ascii?Q?jIa6b4Emkv80uqwsHWAJbinF9Z3x53NAuJnjWrT7A1KBACco8U7UlLcwIzYA?=
 =?us-ascii?Q?YKTaF9AwJx4pDiKg3bdFIa04vrtdE9pHqSzSVEA4C7X5/DNKEtGbR0Y7Y1AF?=
 =?us-ascii?Q?EVtEMe07oGw1HgPnLdF6wsfOiE5YKOWAPFOufv4TrBWFRqP7KbVzp0B2YGvd?=
 =?us-ascii?Q?RjVBkk31dyrAlHLiXAXZcW5wQkic4cHNCKjfiRY2nnAqtP+SWS4Ul8U6sa69?=
 =?us-ascii?Q?amFEOlfCEjQGFoJbkZr9QDhX8e6TGUipMNRd5nPp?=
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: =?us-ascii?Q?nrOP9css4HmjjI38M90+TihWeM1PlfoqM26vi5QvScPH3XOTinThUOSNOQHr?=
 =?us-ascii?Q?AmjPqRrhfJORX4JJha4JCnPs4IeklqBqQ/hwDe6MPtEuOTNgU2DJy+SGL8ae?=
 =?us-ascii?Q?HQ46dZZKAOdqiSSaWl7TQpo8YVsPjgeIxm0sqJsNmcbkcaFCrD5q1qWXQYLL?=
 =?us-ascii?Q?WZm+E+FgGNKj5QZSQ67x3ywEeV2i4ycdx3ME0RylcUFGk48U8RXE1701DHmc?=
 =?us-ascii?Q?INH+tAlBO129d1RH2IHms4XEuq9bFTfQv565mbjKOJh8qPzXQRK5pnPrImtt?=
 =?us-ascii?Q?3IG6a54c1u3/45RYbtRmtivLuc6Qcxk6VkZfU657gj597HCayu/Qu1ULuRmx?=
 =?us-ascii?Q?hovbv/nqH5BCQZLpfQ8pCx0hPqel6W4pCYCJORRkwZdXoweh8aOAganbTrC4?=
 =?us-ascii?Q?alv/OA9ncibTIcJzinv/HVxIlkoPEW+Ym6M8FJxHKcvIooqp2RbsfOg8D3qT?=
 =?us-ascii?Q?s0YqBHnl4fxRPIZJTJCBRXXwEjlJARHwYcNogMQNSr6bofegrqfzhd3YBxpS?=
 =?us-ascii?Q?D9zkXUVVp2xmOtVcL5sU2TZu6e8CcD92YLbN0JpC6gvYV7d3TU14fw1ciFVT?=
 =?us-ascii?Q?QDvlm4lNt4GPpKtdR99a+m6tT2nCt8Mu6OC8g3HCbJo/MnCj4F/P6XiP35gH?=
 =?us-ascii?Q?0aWr60lhIJtOTT3kD+0icDIi+P+IgysQ7B1ehiGPSUPvSUuh3qDR19Y5toXe?=
 =?us-ascii?Q?VLJOhFN092ypIop9vXUL03nHh3Epgn6EgNAgFSuulV1uspy3V+ZT80mmGFf7?=
 =?us-ascii?Q?UzAmTh5gVW4ZK6hgjkS6GEkONR8AlEfT+YbOd2EzelGBTYx5leN6R9vvSz69?=
 =?us-ascii?Q?7WhQ+XQBR1EUgGDcRf+6Pkfoi0f8/KHX1LYCZFKCYbyk2mbabScqmRJPFl+d?=
 =?us-ascii?Q?oZAmiFgmnRnBD19gyQ2/3PaFt9rnZpgYakIja+1ERwqJXlcz04p7q6txzLTR?=
 =?us-ascii?Q?2Q1PVtcOOFFmZ6zlKFyeuQ+JJUNXZcNMKJxo1vPP5Leb7LE+9qtOV4u+i464?=
 =?us-ascii?Q?n6+q?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 2a58ee02-0b40-4400-5d04-08dbc046afa1
X-MS-Exchange-CrossTenant-AuthSource: SN6PR10MB3022.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 28 Sep 2023 17:16:43.0680
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: UHX7smEAFyAJXyXrJ2zAkthRapqhD06pMMaHKCHYcwN10TnVROJsKQicJdL8MMuQiXL4VNgXNuYSFfNXLFYCQg==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH0PR10MB5273
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.267,Aquarius:18.0.980,Hydra:6.0.619,FMLib:17.11.176.26
 definitions=2023-09-28_16,2023-09-28_03,2023-05-22_02
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 bulkscore=0 mlxscore=0
 mlxlogscore=999 suspectscore=0 phishscore=0 adultscore=0 malwarescore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2309180000
 definitions=main-2309280150
X-Proofpoint-GUID: _dFsmhfqiwfKCdybeskL1k6Sx6TMN1k5
X-Proofpoint-ORIG-GUID: _dFsmhfqiwfKCdybeskL1k6Sx6TMN1k5
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,
        RCVD_IN_MSPIKE_H5,RCVD_IN_MSPIKE_WL,SPF_HELO_NONE,SPF_NONE
        autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org
X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (howler.vger.email [0.0.0.0]); Thu, 28 Sep 2023 10:17:15 -0700 (PDT)

When merging of the previous VMA fails after the vma iterator has been
moved to the previous entry, the vma iterator must be advanced to ensure
the caller takes the correct action on the next vma iterator event.  Fix
this by adding a vma_next() call to the error path.

Users would not notice the effects as it would result in an extra
vma_merge() call if the first call ended due to an out-of-memory event.

Link: https://lore.kernel.org/linux-mm/CAG48ez12VN1JAOtTNMY+Y2YnsU45yL5giS-Qn=ejtiHpgJAbdQ@mail.gmail.com/
Closes: https://lore.kernel.org/linux-mm/CAG48ez12VN1JAOtTNMY+Y2YnsU45yL5giS-Qn=ejtiHpgJAbdQ@mail.gmail.com/
Fixes: 18b098af2890 ("vma_merge: set vma iterator to correct position.")
Cc: stable@vger.kernel.org
Cc: Jann Horn <jannh@google.com>
Signed-off-by: Liam R. Howlett <Liam.Howlett@oracle.com>
---
 mm/mmap.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/mm/mmap.c b/mm/mmap.c
index b56a7f0c9f85..a4eb5a5626bb 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -975,7 +975,7 @@ struct vm_area_struct *vma_merge(struct vma_iterator *vmi, struct mm_struct *mm,
 
 	/* Error in anon_vma clone. */
 	if (err)
-		return NULL;
+		goto anon_vma_fail;
 
 	if (vma_start < vma->vm_start || vma_end > vma->vm_end)
 		vma_expanded = true;
@@ -988,7 +988,7 @@ struct vm_area_struct *vma_merge(struct vma_iterator *vmi, struct mm_struct *mm,
 	}
 
 	if (vma_iter_prealloc(vmi, vma))
-		return NULL;
+		goto prealloc_fail;
 
 	init_multi_vma_prep(&vp, vma, adjust, remove, remove2);
 	VM_WARN_ON(vp.anon_vma && adjust && adjust->anon_vma &&
@@ -1016,6 +1016,12 @@ struct vm_area_struct *vma_merge(struct vma_iterator *vmi, struct mm_struct *mm,
 	vma_complete(&vp, vmi, mm);
 	khugepaged_enter_vma(res, vm_flags);
 	return res;
+
+prealloc_fail:
+anon_vma_fail:
+	if (merge_prev)
+		vma_next(vmi);
+	return NULL;
 }
 
 /*
-- 
2.40.1