• Kirill A. Shutemov's avatar
    khugepaged: fix null-pointer dereference due to race · 594cced1
    Kirill A. Shutemov authored
    khugepaged has to drop mmap lock several times while collapsing a page.
    The situation can change while the lock is dropped and we need to
    re-validate that the VMA is still in place and the PMD is still subject
    for collapse.
    
    But we miss one corner case: while collapsing an anonymous pages the VMA
    could be replaced with file VMA.  If the file VMA doesn't have any
    private pages we get NULL pointer dereference:
    
    	general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN
    	KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
    	anon_vma_lock_write include/linux/rmap.h:120 [inline]
    	collapse_huge_page mm/khugepaged.c:1110 [inline]
    	khugepaged_scan_pmd mm/khugepaged.c:1349 [inline]
    	khugepaged_scan_mm_slot mm/khugepaged.c:2110 [inline]
    	khugepaged_do_scan mm/khugepaged.c:2193 [inline]
    	khugepaged+0x3bba/0x5a10 mm/khugepaged.c:2238
    
    The fix is to make sure that the VMA is anonymous in
    hugepage_v...
    594cced1
khugepaged.c 57.9 KB