On Wed, Sep 07, 2016 at 03:25:59PM +0300, Kirill A. Shutemov wrote: > Here's updated version. > > From 14d748bd8a7eb003efc10b1e5d5b8a644e7181b1 Mon Sep 17 00:00:00 2001 > From: "Kirill A. Shutemov" <kirill.shutemov@xxxxxxxxxxxxxxx> > Date: Mon, 29 Aug 2016 15:32:50 +0300 > Subject: [PATCH] khugepaged: fix use-after-free in collapse_huge_page() > > hugepage_vma_revalidate() tries to re-check if we still should try to > collapse small pages into huge one after the re-acquiring mmap_sem. > > The problem Dmitry Vyukov reported[1] is that the vma found by > hugepage_vma_revalidate() can be suitable for huge pages, but not the > same vma we had before dropping mmap_sem. And dereferencing original vma > can lead to fun results.. > > Let's use vma hugepage_vma_revalidate() found instead of assuming it's > the same as what we had before the lock was dropped. > > [1] http://lkml.kernel.org/r/CACT4Y+Z3gigBvhca9kRJFcjX0G70V_nRhbwKBU+yGoESBDKi9Q@xxxxxxxxxxxxxx > > Signed-off-by: Kirill A. Shutemov <kirill.shutemov@xxxxxxxxxxxxxxx> > Reported-by: Dmitry Vyukov <dvyukov@xxxxxxxxxx> > --- > mm/khugepaged.c | 15 ++++++++------- > 1 file changed, 8 insertions(+), 7 deletions(-) Reviewed-by: Andrea Arcangeli <aarcange@xxxxxxxxxx> -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@xxxxxxxxx. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: <a href=mailto:"dont@xxxxxxxxx";> email@xxxxxxxxx </a>