mm, hwpoison: fix possible use-after-free in mf_dax_kill_procs()

After kill_procs(), tk will be freed without being removed from the
to_kill list.  In the next iteration, the freed list entry in the to_kill
list will be accessed, thus leading to use-after-free issue.  Fix it by
reinitializing the to_kill list after unmap_and_kill().

Link: https://lkml.kernel.org/r/20220818130016.45313-5-linmiaohe@huawei.com
Fixes: c36e20249571 ("mm: introduce mf_dax_kill_procs() for fsdax case")
Signed-off-by: Miaohe Lin <linmiaohe@huawei.com>
Cc: Naoya Horiguchi <naoya.horiguchi@nec.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>

diff --git a/mm/memory-failure.c b/mm/memory-failure.c
index 7023c3d8127309a24d374913963c2842e3be67a2..a2f4e8b00a26c5e30b84fc4a4881d735a06c61e4 100644 (file)
--- a/mm/memory-failure.c
+++ b/mm/memory-failure.c
@@ -1658,6 +1658,8 @@ int mf_dax_kill_procs(struct address_space *mapping, pgoff_t index,
                collect_procs_fsdax(page, mapping, index, &to_kill);
                unmap_and_kill(&to_kill, page_to_pfn(page), mapping,
                                index, mf_flags);
+               /* Reinitialize to_kill list for later resuing. */
+               INIT_LIST_HEAD(&to_kill);
 unlock:
                dax_unlock_mapping_entry(mapping, index, cookie);
        }