Skip to content
  • Kirill A. Shutemov's avatar
    mm: fix vma_is_anonymous() false-positives · bfd40eaf
    Kirill A. Shutemov authored
    vma_is_anonymous() relies on ->vm_ops being NULL to detect anonymous
    VMA.  This is unreliable as ->mmap may not set ->vm_ops.
    
    False-positive vma_is_anonymous() may lead to crashes:
    
    	next ffff8801ce5e7040 prev ffff8801d20eca50 mm ffff88019c1e13c0
    	prot 27 anon_vma ffff88019680cdd8 vm_ops 0000000000000000
    	pgoff 0 file ffff8801b2ec2d00 private_data 0000000000000000
    	flags: 0xff(read|write|exec|shared|mayread|maywrite|mayexec|mayshare)
    	------------[ cut here ]------------
    	kernel BUG at mm/memory.c:1422!
    	invalid opcode: 0000 [#1] SMP KASAN
    	CPU: 0 PID: 18486 Comm: syz-executor3 Not tainted 4.18.0-rc3+ #136
    	Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google
    	01/01/2011
    	RIP: 0010:zap_pmd_range mm/memory.c:1421 [inline]
    	RIP: 0010:zap_pud_range mm/memory.c:1466 [inline]
    	RIP: 0010:zap_p4d_range mm/memory.c:1487 [inline]
    	RIP: 0010:unmap_page_range+0x1c18/0x2220 mm/memory.c:1508
    	Call Trace:
    	 unmap_single_vma+0x1a0/0x310 mm/memory.c:15...
    bfd40eaf