Skip to contentSkip to conversation

s390/mm: Check for valid vma before zapping in gmap_discard

PATCH In review Janosch Frank 2 participants 3 messages Nov 8, 2018 – Nov 30, 2018

Subsystems (3)
Stable branch s390 s390 MM
lore
Share & tools
lore

Janosch Frank

author
#0 lore raw

PATCH 1/1 s390/mm: Check for valid vma before zapping in gmap_discard

From: Janosch Frank <[email protected]>

Userspace could have munmapped the area before doing unmapping from the gmap. This would leave us with a valid vmaddr, but an invalid vma from which we would try to zap memory.

Let's check before using the vma.

Fixes 1e133ab296f3 ("s390/mm: split arch/s390/mm/pgtable.c")
Signed-off-by Janosch Frank <[email protected]>
Reviewed-by David Hildenbrand <[email protected]>
Reported-by Dan Carpenter <[email protected]>
CC [email protected] # 4.6+
---
 arch/s390/mm/gmap.c | 2 ++
 1 file changed, 2 insertions(+)
arch/s390/mm/gmap.c +2 -0
index cb2cd04..b6c85b7 100644
@@ -686,6 +686,8 @@ void gmap_discard(struct gmap *gmap, unsigned long from, unsigned long to)
 		vmaddr |= gaddr & ~PMD_MASK;
 		/* Find vma in the parent mm */
 		vma = find_vma(gmap->mm, vmaddr);
+		if (!vma)
+			continue;
 		size = min(to - gaddr, PMD_SIZE - (gaddr & ~PMD_MASK));
 		zap_page_range(vma, vmaddr, size, NULL);
 	}
Signature · 1 line
2.7.4
maintainer
#1 lore raw
Quoted 8 lines · Janosch Frank

From: Janosch Frank <[email protected]>

Userspace could have munmapped the area before doing unmapping from the gmap. This would leave us with a valid vmaddr, but an invalid vma from which we would try to zap memory.

Let's check before using the vma.

Quoted 8 lines
Fixes 1e133ab296f3 ("s390/mm: split arch/s390/mm/pgtable.c")
Signed-off-by Janosch Frank <[email protected]>
Reviewed-by David Hildenbrand <[email protected]>
Reported-by Dan Carpenter <[email protected]>
CC [email protected] # 4.6+
---
 arch/s390/mm/gmap.c | 2 ++
 1 file changed, 2 insertions(+)

Please always include the upstream git commit id so that I have a clue as to what it is when doing the backport.

thanks,

greg k-h

author
#2 lore raw
Quoted 18 lines · Greg KH
Quoted 8 lines · Janosch Frank

From: Janosch Frank <[email protected]>

Userspace could have munmapped the area before doing unmapping from the gmap. This would leave us with a valid vmaddr, but an invalid vma from which we would try to zap memory.

Let's check before using the vma.

Quoted 8 lines
Fixes 1e133ab296f3 ("s390/mm: split arch/s390/mm/pgtable.c")
Signed-off-by Janosch Frank <[email protected]>
Reviewed-by David Hildenbrand <[email protected]>
Reported-by Dan Carpenter <[email protected]>
CC [email protected] # 4.6+
---
 arch/s390/mm/gmap.c | 2 ++
 1 file changed, 2 insertions(+)
Quoted 3 lines

Please always include the upstream git commit id so that I have a clue as to what it is when doing the backport.

It's:
1843abd03250115af6cec0892683e70cf2297c25

Will do next time, or rather next time we won't forget to CC stable :-)