diff options
| author | Vishal Moola (Oracle) <vishal.moola@gmail.com> | 2024-09-14 12:41:19 -0700 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2024-10-04 16:33:48 +0200 |
| commit | e897d184a8dd4a4e1f39c8c495598e4d9472776c (patch) | |
| tree | 33a6b77172e54f353e3656e737648f916b58944c /tools/perf/scripts/python/stackcollapse.py | |
| parent | d4ed0cf0eeaa1f9c19759878de239e5beabb4cc6 (diff) | |
mm/hugetlb.c: fix UAF of vma in hugetlb fault pathway
commit 98b74bb4d7e96b4da5ef3126511febe55b76b807 upstream.
Syzbot reports a UAF in hugetlb_fault(). This happens because
vmf_anon_prepare() could drop the per-VMA lock and allow the current VMA
to be freed before hugetlb_vma_unlock_read() is called.
We can fix this by using a modified version of vmf_anon_prepare() that
doesn't release the VMA lock on failure, and then release it ourselves
after hugetlb_vma_unlock_read().
Link: https://lkml.kernel.org/r/20240914194243.245-2-vishal.moola@gmail.com
Fixes: 9acad7ba3e25 ("hugetlb: use vmf_anon_prepare() instead of anon_vma_prepare()")
Reported-by: syzbot+2dab93857ee95f2eeb08@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/linux-mm/00000000000067c20b06219fbc26@google.com/
Signed-off-by: Vishal Moola (Oracle) <vishal.moola@gmail.com>
Cc: Muchun Song <muchun.song@linux.dev>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'tools/perf/scripts/python/stackcollapse.py')
0 files changed, 0 insertions, 0 deletions