Set ->vm_next and ->vm_prev to NULL to prevent potential misuse from the new duplicated vma. Currently, only in fork path there are misuse for handling anon_vma. No other bugs been revealed with this patch applied.
Unified · Split
| @@ -361,6 +361,7 @@ struct vm_area_struct *vm_area_dup(struct vm_area_struct *orig) · 360 unmodified lines | ||
| 361 | 361 | if (new) { |
| 362 | 362 | *new = *orig; |
| 363 | 363 | INIT_LIST_HEAD(&new->anon_vma_chain); |
| 364 | + new->vm_next = new->vm_prev = NULL; | |
| 364 | 365 | } |
| 365 | 366 | return new; |
| 366 | 367 | } |
| @@ -562,7 +563,6 @@ static __latent_entropy int dup_mmap(struct mm_struct *mm, · 195 unmodified lines | ||
| 562 | 563 | } else if (anon_vma_fork(tmp, mpnt)) |
| 563 | 564 | goto fail_nomem_anon_vma_fork; |
| 564 | 565 | tmp->vm_flags &= ~(VM_LOCKED | VM_LOCKONFAULT); |
| 565 | − tmp->vm_next = tmp->vm_prev = NULL; | |
| 566 | 566 | file = tmp->vm_file; |
| 567 | 567 | if (file) { |
| 568 | 568 | struct inode *inode = file_inode(file); |