On Mon, Apr 24, 2023 at 11:31:08AM -0400, Liam R. Howlett wrote: > [ Upstream commit f4e9e0e69468583c2c6d9d5c7bfc975e292bf188 ] > > set_mempolicy_home_node() iterates over a list of VMAs and calls > mbind_range() on each VMA, which also iterates over the singular list of > the VMA passed in and potentially splits the VMA. Since the VMA iterator > is not passed through, set_mempolicy_home_node() may now point to a stale > node in the VMA tree. This can result in a UAF as reported by syzbot. > > Avoid the stale maple tree node by passing the VMA iterator through to the > underlying call to split_vma(). > > mbind_range() is also overly complicated, since there are two calling > functions and one already handles iterating over the VMAs. Simplify > mbind_range() to only handle merging and splitting of the VMAs. > > Align the new loop in do_mbind() and existing loop in > set_mempolicy_home_node() to use the reduced mbind_range() function. This > allows for a single location of the range calculation and avoids > constantly looking up the previous VMA (since this is a loop over the > VMAs). > > Link: https://lore.kernel.org/linux-mm/000000000000c93feb05f87e24ad@xxxxxxxxxx/ > Fixes: 66850be55e8e ("mm/mempolicy: use vma iterator & maple state instead of vma linked list") > Signed-off-by: Liam R. Howlett <Liam.Howlett@xxxxxxxxxx> > Reported-by: syzbot+a7c1ec5b1d71ceaa5186@xxxxxxxxxxxxxxxxxxxxxxxxx > Link: https://lkml.kernel.org/r/20230410152205.2294819-1-Liam.Howlett@xxxxxxxxxx > Tested-by: syzbot+a7c1ec5b1d71ceaa5186@xxxxxxxxxxxxxxxxxxxxxxxxx > Cc: <stable@xxxxxxxxxxxxxxx> > Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> > (cherry picked from commit f4e9e0e69468583c2c6d9d5c7bfc975e292bf188) > Signed-off-by: Liam R. Howlett <Liam.Howlett@xxxxxxxxxx> > (cherry picked from commit 905e8727c6aca577a8151105a6e0912591649690) There is no such commit in Linus's tree. Please be more careful in the future...
