Set ->vm_next and ->vm_prev to NULL to prevent potential misuse from the new duplicated vma. Currently, only in fork path there are misuse for handling anon_vma. No other bugs been revealed with this patch applied.
Unified · Split
| @@ -361,6 +361,7 @@ struct vm_area_struct *vm_area_dup(struct vm_area_struct *orig) · 360 unmodified lines | |||
| 361 | if (new) { | 361 | if (new) { |
| 362 | *new = *orig; | 362 | *new = *orig; |
| 363 | INIT_LIST_HEAD(&new->anon_vma_chain); | 363 | INIT_LIST_HEAD(&new->anon_vma_chain); |
| 364 | new->vm_next = new->vm_prev = NULL; | ||
| 364 | } | 365 | } |
| 365 | return new; | 366 | return new; |
| 366 | } | 367 | } |
| @@ -562,7 +563,6 @@ static __latent_entropy int dup_mmap(struct mm_struct *mm, · 195 unmodified lines | |||
| 562 | } else if (anon_vma_fork(tmp, mpnt)) | 563 | } else if (anon_vma_fork(tmp, mpnt)) |
| 563 | goto fail_nomem_anon_vma_fork; | 564 | goto fail_nomem_anon_vma_fork; |
| 564 | tmp->vm_flags &= ~(VM_LOCKED | VM_LOCKONFAULT); | 565 | tmp->vm_flags &= ~(VM_LOCKED | VM_LOCKONFAULT); |
| 565 | tmp->vm_next = tmp->vm_prev = NULL; | ||
| 566 | file = tmp->vm_file; | 566 | file = tmp->vm_file; |
| 567 | if (file) { | 567 | if (file) { |
| 568 | struct inode *inode = file_inode(file); | 568 | struct inode *inode = file_inode(file); |