Commit 824135c4 authored by Liam R. Howlett's avatar Liam R. Howlett Committed by Andrew Morton
Browse files

mmap: fix error paths with dup_anon_vma() 

When the calling function fails after the dup_anon_vma(), the
duplication of the anon_vma is not being undone.  Add the necessary
unlink_anon_vma() call to the error paths that are missing them.

This issue showed up during inspection of the error path in vma_merge()
for an unrelated vma iterator issue.

Users may experience increased memory usage, which may be problematic as
the failure would likely be caused by a low memory situation.

Link: https://lkml.kernel.org/r/20230929183041.2835469-3-Liam.Howlett@oracle.com


Fixes: d4af56c5 ("mm: start tracking VMAs with maple tree")
Signed-off-by: default avatarLiam R. Howlett <Liam.Howlett@oracle.com>
Reviewed-by: default avatarLorenzo Stoakes <lstoakes@gmail.com>
Acked-by: default avatarVlastimil Babka <vbabka@suse.cz>
Cc: Jann Horn <jannh@google.com>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
parent 1419430c

mm/mmap.c

+22 −8
Original line number Diff line number Diff line
@@ -583,11 +583,12 @@ static inline void vma_complete(struct vma_prepare *vp, 
 * dup_anon_vma() - Helper function to duplicate anon_vma

 * @dst: The destination VMA

 * @src: The source VMA

 * @dup: Pointer to the destination VMA when successful.

 *

 * Returns: 0 on success.

 */

static inline int dup_anon_vma(struct vm_area_struct *dst,

			       struct vm_area_struct *src)

		struct vm_area_struct *src, struct vm_area_struct **dup)

{

	/*

	 * Easily overlooked: when mprotect shifts the boundary, make sure the
@@ -595,9 +596,15 @@ static inline int dup_anon_vma(struct vm_area_struct *dst, 
	 * anon pages imported.

	 */

	if (src->anon_vma && !dst->anon_vma) {

		int ret;



		vma_assert_write_locked(dst);

		dst->anon_vma = src->anon_vma;

		return anon_vma_clone(dst, src);

		ret = anon_vma_clone(dst, src);

		if (ret)

			return ret;



		*dup = dst;

	}



	return 0;
@@ -624,6 +631,7 @@ int vma_expand(struct vma_iterator *vmi, struct vm_area_struct *vma, 
	       unsigned long start, unsigned long end, pgoff_t pgoff,

	       struct vm_area_struct *next)

{

	struct vm_area_struct *anon_dup = NULL;

	bool remove_next = false;

	struct vma_prepare vp;
@@ -633,7 +641,7 @@ int vma_expand(struct vma_iterator *vmi, struct vm_area_struct *vma, 


		remove_next = true;

		vma_start_write(next);

		ret = dup_anon_vma(vma, next);

		ret = dup_anon_vma(vma, next, &anon_dup);

		if (ret)

			return ret;

	}
@@ -661,6 +669,8 @@ int vma_expand(struct vma_iterator *vmi, struct vm_area_struct *vma, 
	return 0;



nomem:

	if (anon_dup)

		unlink_anon_vmas(anon_dup);

	return -ENOMEM;

}
@@ -860,6 +870,7 @@ struct vm_area_struct *vma_merge(struct vma_iterator *vmi, struct mm_struct *mm, 
{

	struct vm_area_struct *curr, *next, *res;

	struct vm_area_struct *vma, *adjust, *remove, *remove2;

	struct vm_area_struct *anon_dup = NULL;

	struct vma_prepare vp;

	pgoff_t vma_pgoff;

	int err = 0;
@@ -927,18 +938,18 @@ struct vm_area_struct *vma_merge(struct vma_iterator *vmi, struct mm_struct *mm, 
		vma_start_write(next);

		remove = next;				/* case 1 */

		vma_end = next->vm_end;

		err = dup_anon_vma(prev, next);

		err = dup_anon_vma(prev, next, &anon_dup);

		if (curr) {				/* case 6 */

			vma_start_write(curr);

			remove = curr;

			remove2 = next;

			if (!next->anon_vma)

				err = dup_anon_vma(prev, curr);

				err = dup_anon_vma(prev, curr, &anon_dup);

		}

	} else if (merge_prev) {			/* case 2 */

		if (curr) {

			vma_start_write(curr);

			err = dup_anon_vma(prev, curr);

			err = dup_anon_vma(prev, curr, &anon_dup);

			if (end == curr->vm_end) {	/* case 7 */

				remove = curr;

			} else {			/* case 5 */
@@ -954,7 +965,7 @@ struct vm_area_struct *vma_merge(struct vma_iterator *vmi, struct mm_struct *mm, 
			vma_end = addr;

			adjust = next;

			adj_start = -(prev->vm_end - addr);

			err = dup_anon_vma(next, prev);

			err = dup_anon_vma(next, prev, &anon_dup);

		} else {

			/*

			 * Note that cases 3 and 8 are the ONLY ones where prev
@@ -968,7 +979,7 @@ struct vm_area_struct *vma_merge(struct vma_iterator *vmi, struct mm_struct *mm, 
				vma_pgoff = curr->vm_pgoff;

				vma_start_write(curr);

				remove = curr;

				err = dup_anon_vma(next, curr);

				err = dup_anon_vma(next, curr, &anon_dup);

			}

		}

	}
@@ -1018,6 +1029,9 @@ struct vm_area_struct *vma_merge(struct vma_iterator *vmi, struct mm_struct *mm, 
	return res;



prealloc_fail:

	if (anon_dup)

		unlink_anon_vmas(anon_dup);



anon_vma_fail:

	vma_iter_set(vmi, addr);

	vma_iter_load(vmi);