From: Miaohe Lin Date: Thu, 18 Aug 2022 13:00:14 +0000 (+0800) Subject: mm, hwpoison: fix possible use-after-free in mf_dax_kill_procs() X-Git-Url: https://www.infradead.org/git/?a=commitdiff_plain;h=07f858dcdf8395a999023a5eebfa629c10943673;p=users%2Fjedix%2Flinux-maple.git mm, hwpoison: fix possible use-after-free in mf_dax_kill_procs() After kill_procs(), tk will be freed without being removed from the to_kill list. In the next iteration, the freed list entry in the to_kill list will be accessed, thus leading to use-after-free issue. Fix it by reinitializing the to_kill list after unmap_and_kill(). Link: https://lkml.kernel.org/r/20220818130016.45313-5-linmiaohe@huawei.com Fixes: c36e20249571 ("mm: introduce mf_dax_kill_procs() for fsdax case") Signed-off-by: Miaohe Lin Cc: Naoya Horiguchi Signed-off-by: Andrew Morton --- diff --git a/mm/memory-failure.c b/mm/memory-failure.c index 7023c3d812730..a2f4e8b00a26c 100644 --- a/mm/memory-failure.c +++ b/mm/memory-failure.c @@ -1658,6 +1658,8 @@ int mf_dax_kill_procs(struct address_space *mapping, pgoff_t index, collect_procs_fsdax(page, mapping, index, &to_kill); unmap_and_kill(&to_kill, page_to_pfn(page), mapping, index, mf_flags); + /* Reinitialize to_kill list for later resuing. */ + INIT_LIST_HEAD(&to_kill); unlock: dax_unlock_mapping_entry(mapping, index, cookie); }