diff options
| author | Chengming Zhou <chengming.zhou@linux.dev> | 2024-05-13 05:07:56 +0200 |
|---|---|---|
| committer | Andrew Morton <akpm@linux-foundation.org> | 2024-05-24 20:55:08 +0200 |
| commit | 90e823498881fb8a91d83e9a8eed87c8c3ff2176 (patch) | |
| tree | 6e62d929cf84ea3b5b4831c976807c8960801218 /io_uring/futex.h | |
| parent | mm/memory-failure: fix handling of dissolved but not taken off from buddy pages (diff) | |
| download | linux-90e823498881fb8a91d83e9a8eed87c8c3ff2176.tar.xz linux-90e823498881fb8a91d83e9a8eed87c8c3ff2176.zip | |
mm/ksm: fix possible UAF of stable_node
The commit 2c653d0ee2ae ("ksm: introduce ksm_max_page_sharing per page
deduplication limit") introduced a possible failure case in the
stable_tree_insert(), where we may free the new allocated stable_node_dup
if we fail to prepare the missing chain node.
Then that kfolio return and unlock with a freed stable_node set... And
any MM activities can come in to access kfolio->mapping, so UAF.
Fix it by moving folio_set_stable_node() to the end after stable_node
is inserted successfully.
Link: https://lkml.kernel.org/r/20240513-b4-ksm-stable-node-uaf-v1-1-f687de76f452@linux.dev
Fixes: 2c653d0ee2ae ("ksm: introduce ksm_max_page_sharing per page deduplication limit")
Signed-off-by: Chengming Zhou <chengming.zhou@linux.dev>
Acked-by: David Hildenbrand <david@redhat.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: Stefan Roesch <shr@devkernel.io>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Diffstat (limited to 'io_uring/futex.h')
0 files changed, 0 insertions, 0 deletions