From 07f858dcdf8395a999023a5eebfa629c10943673 Mon Sep 17 00:00:00 2001 From: Miaohe Lin Date: Thu, 18 Aug 2022 21:00:14 +0800 Subject: [PATCH] mm, hwpoison: fix possible use-after-free in mf_dax_kill_procs() After kill_procs(), tk will be freed without being removed from the to_kill list. In the next iteration, the freed list entry in the to_kill list will be accessed, thus leading to use-after-free issue. Fix it by reinitializing the to_kill list after unmap_and_kill(). Link: https://lkml.kernel.org/r/20220818130016.45313-5-linmiaohe@huawei.com Fixes: c36e20249571 ("mm: introduce mf_dax_kill_procs() for fsdax case") Signed-off-by: Miaohe Lin Cc: Naoya Horiguchi Signed-off-by: Andrew Morton --- mm/memory-failure.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/mm/memory-failure.c b/mm/memory-failure.c index 7023c3d81273..a2f4e8b00a26 100644 --- a/mm/memory-failure.c +++ b/mm/memory-failure.c @@ -1658,6 +1658,8 @@ int mf_dax_kill_procs(struct address_space *mapping, pgoff_t index, collect_procs_fsdax(page, mapping, index, &to_kill); unmap_and_kill(&to_kill, page_to_pfn(page), mapping, index, mf_flags); + /* Reinitialize to_kill list for later resuing. */ + INIT_LIST_HEAD(&to_kill); unlock: dax_unlock_mapping_entry(mapping, index, cookie); } -- 2.50.1