[PATCH 4.9+] s390/mm: Check for valid vma before zapping in gmap_discard

[PATCH 4.9+] s390/mm: Check for valid vma before zapping in gmap_discard

[Janosch Frank]

From: Janosch Frank <frankja@de.ibm.com>

Userspace could have munmapped the area before doing unmapping from the
gmap. This would leave us with a valid vmaddr, but an invalid vma from
which we would try to zap memory.

Let's check before using the vma.

Fixes: 1e133ab296f3 ("s390/mm: split arch/s390/mm/pgtable.c")
Signed-off-by: Janosch Frank <frankja@linux.ibm.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
CC: stable@vger.kernel.org # 4.6+
---
 arch/s390/mm/gmap.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/s390/mm/gmap.c b/arch/s390/mm/gmap.c
index cb2cd04..b6c85b7 100644
--- a/arch/s390/mm/gmap.c
+++ b/arch/s390/mm/gmap.c
@@ -686,6 +686,8 @@ void gmap_discard(struct gmap *gmap, unsigned long from, unsigned long to)
 		vmaddr |= gaddr & ~PMD_MASK;
 		/* Find vma in the parent mm */
 		vma = find_vma(gmap->mm, vmaddr);
+		if (!vma)
+			continue;
 		size = min(to - gaddr, PMD_SIZE - (gaddr & ~PMD_MASK));
 		zap_page_range(vma, vmaddr, size, NULL);
 	}
-- 
2.7.4

Re: [PATCH 4.9+] s390/mm: Check for valid vma before zapping in gmap_discard

[Greg KH]

On Thu, Nov 08, 2018 at 09:41:00AM +0100, Janosch Frank wrote:
> From: Janosch Frank <frankja@de.ibm.com>
> 
> Userspace could have munmapped the area before doing unmapping from the
> gmap. This would leave us with a valid vmaddr, but an invalid vma from
> which we would try to zap memory.
> 
> Let's check before using the vma.
> 
> Fixes: 1e133ab296f3 ("s390/mm: split arch/s390/mm/pgtable.c")
> Signed-off-by: Janosch Frank <frankja@linux.ibm.com>
> Reviewed-by: David Hildenbrand <david@redhat.com>
> Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
> CC: stable@vger.kernel.org # 4.6+
> ---
>  arch/s390/mm/gmap.c | 2 ++
>  1 file changed, 2 insertions(+)

Please always include the upstream git commit id so that I have a clue
as to what it is when doing the backport.

thanks,

greg k-h

Re: [PATCH 4.9+] s390/mm: Check for valid vma before zapping in gmap_discard

[Janosch Frank]

[-- Attachment #1.1: Type: text/plain, Size: 988 bytes --]

On 29.11.18 13:33, Greg KH wrote:
> On Thu, Nov 08, 2018 at 09:41:00AM +0100, Janosch Frank wrote:
>> From: Janosch Frank <frankja@de.ibm.com>
>>
>> Userspace could have munmapped the area before doing unmapping from the
>> gmap. This would leave us with a valid vmaddr, but an invalid vma from
>> which we would try to zap memory.
>>
>> Let's check before using the vma.
>>
>> Fixes: 1e133ab296f3 ("s390/mm: split arch/s390/mm/pgtable.c")
>> Signed-off-by: Janosch Frank <frankja@linux.ibm.com>
>> Reviewed-by: David Hildenbrand <david@redhat.com>
>> Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
>> CC: stable@vger.kernel.org # 4.6+
>> ---
>>  arch/s390/mm/gmap.c | 2 ++
>>  1 file changed, 2 insertions(+)
> 
> Please always include the upstream git commit id so that I have a clue
> as to what it is when doing the backport.
> 
It's:
1843abd03250115af6cec0892683e70cf2297c25

Will do next time, or rather next time we won't forget to CC stable :-)


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 819 bytes --]