Re: mm: use-after-free in collapse_huge_page

[Andrea Arcangeli]

On Wed, Sep 07, 2016 at 03:25:59PM +0300, Kirill A. Shutemov wrote:
> Here's updated version.
> 
> From 14d748bd8a7eb003efc10b1e5d5b8a644e7181b1 Mon Sep 17 00:00:00 2001
> From: "Kirill A. Shutemov" <kirill.shutemov@xxxxxxxxxxxxxxx>
> Date: Mon, 29 Aug 2016 15:32:50 +0300
> Subject: [PATCH] khugepaged: fix use-after-free in collapse_huge_page()
> 
> hugepage_vma_revalidate() tries to re-check if we still should try to
> collapse small pages into huge one after the re-acquiring mmap_sem.
> 
> The problem Dmitry Vyukov reported[1] is that the vma found by
> hugepage_vma_revalidate() can be suitable for huge pages, but not the
> same vma we had before dropping mmap_sem. And dereferencing original vma
> can lead to fun results..
> 
> Let's use vma hugepage_vma_revalidate() found instead of assuming it's
> the same as what we had before the lock was dropped.
> 
> [1] http://lkml.kernel.org/r/CACT4Y+Z3gigBvhca9kRJFcjX0G70V_nRhbwKBU+yGoESBDKi9Q@xxxxxxxxxxxxxx
> 
> Signed-off-by: Kirill A. Shutemov <kirill.shutemov@xxxxxxxxxxxxxxx>
> Reported-by: Dmitry Vyukov <dvyukov@xxxxxxxxxx>
> ---
>  mm/khugepaged.c | 15 ++++++++-------
>  1 file changed, 8 insertions(+), 7 deletions(-)

Reviewed-by: Andrea Arcangeli <aarcange@xxxxxxxxxx>