Files
odroid-linux/include/linux
Kirill A. Shutemov bfd40eaff5 mm: fix vma_is_anonymous() false-positives
vma_is_anonymous() relies on ->vm_ops being NULL to detect anonymous
VMA.  This is unreliable as ->mmap may not set ->vm_ops.

False-positive vma_is_anonymous() may lead to crashes:

	next ffff8801ce5e7040 prev ffff8801d20eca50 mm ffff88019c1e13c0
	prot 27 anon_vma ffff88019680cdd8 vm_ops 0000000000000000
	pgoff 0 file ffff8801b2ec2d00 private_data 0000000000000000
	flags: 0xff(read|write|exec|shared|mayread|maywrite|mayexec|mayshare)
	------------[ cut here ]------------
	kernel BUG at mm/memory.c:1422!
	invalid opcode: 0000 [#1] SMP KASAN
	CPU: 0 PID: 18486 Comm: syz-executor3 Not tainted 4.18.0-rc3+ #136
	Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google
	01/01/2011
	RIP: 0010:zap_pmd_range mm/memory.c:1421 [inline]
	RIP: 0010:zap_pud_range mm/memory.c:1466 [inline]
	RIP: 0010:zap_p4d_range mm/memory.c:1487 [inline]
	RIP: 0010:unmap_page_range+0x1c18/0x2220 mm/memory.c:1508
	Call Trace:
	 unmap_single_vma+0x1a0/0x310 mm/memory.c:1553
	 zap_page_range_single+0x3cc/0x580 mm/memory.c:1644
	 unmap_mapping_range_vma mm/memory.c:2792 [inline]
	 unmap_mapping_range_tree mm/memory.c:2813 [inline]
	 unmap_mapping_pages+0x3a7/0x5b0 mm/memory.c:2845
	 unmap_mapping_range+0x48/0x60 mm/memory.c:2880
	 truncate_pagecache+0x54/0x90 mm/truncate.c:800
	 truncate_setsize+0x70/0xb0 mm/truncate.c:826
	 simple_setattr+0xe9/0x110 fs/libfs.c:409
	 notify_change+0xf13/0x10f0 fs/attr.c:335
	 do_truncate+0x1ac/0x2b0 fs/open.c:63
	 do_sys_ftruncate+0x492/0x560 fs/open.c:205
	 __do_sys_ftruncate fs/open.c:215 [inline]
	 __se_sys_ftruncate fs/open.c:213 [inline]
	 __x64_sys_ftruncate+0x59/0x80 fs/open.c:213
	 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
	 entry_SYSCALL_64_after_hwframe+0x49/0xbe

Reproducer:

	#include <stdio.h>
	#include <stddef.h>
	#include <stdint.h>
	#include <stdlib.h>
	#include <string.h>
	#include <sys/types.h>
	#include <sys/stat.h>
	#include <sys/ioctl.h>
	#include <sys/mman.h>
	#include <unistd.h>
	#include <fcntl.h>

	#define KCOV_INIT_TRACE			_IOR('c', 1, unsigned long)
	#define KCOV_ENABLE			_IO('c', 100)
	#define KCOV_DISABLE			_IO('c', 101)
	#define COVER_SIZE			(1024<<10)

	#define KCOV_TRACE_PC  0
	#define KCOV_TRACE_CMP 1

	int main(int argc, char **argv)
	{
		int fd;
		unsigned long *cover;

		system("mount -t debugfs none /sys/kernel/debug");
		fd = open("/sys/kernel/debug/kcov", O_RDWR);
		ioctl(fd, KCOV_INIT_TRACE, COVER_SIZE);
		cover = mmap(NULL, COVER_SIZE * sizeof(unsigned long),
				PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0);
		munmap(cover, COVER_SIZE * sizeof(unsigned long));
		cover = mmap(NULL, COVER_SIZE * sizeof(unsigned long),
				PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, 0);
		memset(cover, 0, COVER_SIZE * sizeof(unsigned long));
		ftruncate(fd, 3UL << 20);
		return 0;
	}

This can be fixed by assigning anonymous VMAs own vm_ops and not relying
on it being NULL.

If ->mmap() failed to set ->vm_ops, mmap_region() will set it to
dummy_vm_ops.  This way we will have non-NULL ->vm_ops for all VMAs.

Link: http://lkml.kernel.org/r/20180724121139.62570-4-kirill.shutemov@linux.intel.com
Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Reported-by: syzbot+3f84280d52be9b7083cc@syzkaller.appspotmail.com
Acked-by: Linus Torvalds <torvalds@linux-foundation.org>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2018-07-26 19:38:03 -07:00
..
2018-05-25 18:23:56 +02:00
2018-05-23 14:01:03 +02:00
2018-06-05 10:48:09 -04:00
2018-06-07 14:23:08 +01:00
2018-07-22 11:51:30 -07:00
2018-05-26 09:16:44 +02:00
2018-06-15 18:10:01 -03:00
2018-04-20 17:18:35 -07:00
2018-04-30 13:25:14 +01:00
2017-06-08 18:52:36 -07:00
2018-06-14 17:01:45 +02:00
2018-03-16 10:56:13 +01:00
2018-05-09 17:25:13 +02:00
2017-11-15 18:21:04 -08:00
2018-06-15 18:10:01 -03:00
2018-03-16 15:45:51 -07:00
2018-03-16 10:55:47 +01:00
2018-03-26 15:09:38 +02:00
2017-08-24 13:23:03 -07:00
2017-11-27 16:19:56 -05:00
2018-06-01 07:38:16 -06:00
2018-01-01 12:40:27 -07:00
2018-03-26 15:56:44 +02:00
2017-08-07 17:22:14 +02:00
2017-11-13 01:41:20 +01:00
2018-07-03 18:33:19 -04:00
2018-04-26 09:02:01 -06:00
2018-06-07 17:34:37 -07:00
2018-05-22 13:42:16 +02:00
2018-02-22 21:13:03 +01:00
2017-06-21 14:37:12 -04:00
2018-03-26 08:53:43 -06:00
2018-01-17 11:30:16 +00:00
2018-05-09 12:21:46 -05:00
2018-06-21 17:39:18 +02:00
2018-04-11 10:28:38 -07:00
2017-11-15 18:21:01 -08:00
2017-12-01 13:09:40 -08:00
2018-04-12 09:41:19 -07:00
2017-08-28 20:51:22 +02:00
2018-06-05 08:50:16 -04:00
2018-06-15 07:55:25 +09:00
2018-06-07 17:34:35 -07:00
2018-04-11 10:28:32 -07:00
2018-06-07 17:34:37 -07:00
2018-06-07 17:34:39 -07:00
2018-03-26 13:14:43 -04:00
2018-03-26 13:14:43 -04:00
2017-11-17 16:10:00 -08:00
2018-01-28 22:17:24 -05:00
2017-07-25 18:05:25 +02:00
2018-06-01 14:37:35 +02:00
2018-01-08 08:22:45 -06:00
2018-01-17 15:25:50 +01:00
2018-01-08 08:22:45 -06:00
2018-06-07 17:34:36 -07:00
2018-04-11 10:28:39 -07:00
2018-01-31 17:18:37 -08:00
2017-11-09 10:23:28 +01:00
2018-06-06 16:10:45 -05:00
2018-05-15 15:51:38 +01:00
2018-07-18 15:40:26 -05:00
2018-06-07 17:34:35 -07:00
2017-11-17 16:10:04 -08:00
2017-11-17 16:10:04 -08:00
2017-11-13 01:33:48 +01:00
2017-12-16 02:05:48 +01:00
2018-05-31 00:13:56 +08:00
2018-05-11 17:28:45 -07:00
2018-05-11 17:28:45 -07:00
2018-06-04 17:28:20 -04:00
2018-03-01 08:33:05 -07:00
2017-11-07 12:22:21 +01:00
2018-06-29 08:48:06 -06:00
2018-05-04 12:48:54 -07:00
2018-04-30 05:14:55 -07:00
2018-06-07 17:34:35 -07:00
2018-05-03 15:55:23 -07:00
2018-01-15 12:07:46 -08:00
2018-04-16 14:25:08 -06:00
2018-02-06 18:32:47 -08:00
2018-01-09 16:27:43 +01:00
2018-05-18 11:40:27 -04:00
2018-05-19 13:57:31 +02:00
2018-05-19 13:57:31 +02:00
2018-04-26 15:08:04 -04:00
2018-02-06 18:32:44 -08:00
2017-12-20 09:53:54 -07:00
2017-10-04 10:29:22 +02:00
2018-05-14 09:51:34 -04:00
2017-08-15 09:02:07 -07:00
2017-08-15 09:02:08 -07:00