Sean Christopherson ba42273131 mm/mmu_notifier: mm/rmap.c: Fix a mmu_notifier range bug in try_to_unmap_one ... The conversion to use a structure for mmu_notifier_invalidate_range_*() unintentionally changed the usage in try_to_unmap_one() to init the 'struct mmu_notifier_range' with vma->vm_start instead of @address, i.e. it invalidates the wrong address range. Revert to the correct address range. Manifests as KVM use-after-free WARNINGs and subsequent "BUG: Bad page state in process X" errors when reclaiming from a KVM guest due to KVM removing the wrong pages from its own mappings. Reported-by: leozinho29_eu@hotmail.com Reported-by: Mike Galbraith <efault@gmx.de> Reported-and-tested-by: Adam Borowski <kilobyte@angband.pl> Reviewed-by: Jérôme Glisse <jglisse@redhat.com> Reviewed-by: Pankaj gupta <pagupta@redhat.com> Cc: Christian König <christian.koenig@amd.com> Cc: Jan Kara <jack@suse.cz> Cc: Matthew Wilcox <mawilcox@microsoft.com> Cc: Ross Zwisler <zwisler@kernel.org> Cc: Dan Williams <dan.j.williams@intel.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Radim Krčmář <rkrcmar@redhat.com> Cc: Michal Hocko <mhocko@kernel.org> Cc: Felix Kuehling <felix.kuehling@amd.com> Cc: Ralph Campbell <rcampbell@nvidia.com> Cc: John Hubbard <jhubbard@nvidia.com> Cc: Andrew Morton <akpm@linux-foundation.org> Fixes: ac46d4f3c4 ("mm/mmu_notifier: use structure for invalidate_range_start/end calls v2") Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>		2019-01-10 02:58:21 -08:00
..
kasan	kasan: fix krealloc handling for tag-based mode	2019-01-08 17:15:11 -08:00
Kconfig	ksm: replace jhash2 with xxhash	2018-12-28 12:11:46 -08:00
Kconfig.debug	…
Makefile	mm: remove nobootmem	2018-10-31 08:54:16 -07:00
backing-dev.c	…
balloon_compaction.c	…
cleancache.c	…
cma.c	kasan, mm, arm64: tag non slab memory allocated via pagealloc	2018-12-28 12:11:44 -08:00
cma.h	…
cma_debug.c	…
compaction.c	mm: move zone watermark accesses behind an accessor	2018-12-28 12:11:48 -08:00
debug.c	mm/debug.c: make "migrate_reason_names[]" const char *	2018-12-28 12:11:48 -08:00
debug_page_ref.c	…
dmapool.c	…
early_ioremap.c	…
fadvise.c	…
failslab.c	…
filemap.c	mm/: remove caller signal_pending branch predictions	2019-01-04 13:13:48 -08:00
frame_vector.c	…
frontswap.c	…
gup.c	Merge branch 'akpm' (patches from Andrew)	2019-01-05 09:16:18 -08:00
gup_benchmark.c	mm/gup_benchmark.c: prevent integer overflow in ioctl	2018-10-31 08:54:12 -07:00
highmem.c	mm: convert totalram_pages and totalhigh_pages variables to atomic	2018-12-28 12:11:47 -08:00
hmm.c	mm/hmm: fix memremap.h, move dev_page_fault_t callback to hmm	2018-12-28 12:11:52 -08:00
huge_memory.c	mm: treewide: remove unused address argument from pte_alloc functions	2019-01-04 13:13:47 -08:00
hugetlb.c	hugetlbfs: revert "use i_mmap_rwsem for more pmd sharing synchronization"	2019-01-08 17:15:11 -08:00
hugetlb_cgroup.c	…
hwpoison-inject.c	…
init-mm.c	…
internal.h	mm: use alloc_flags to record if kswapd can wake	2018-12-28 12:11:48 -08:00
interval_tree.c	…
khugepaged.c	mm/mmu_notifier: use structure for invalidate_range_start/end calls v2	2018-12-28 12:11:50 -08:00
kmemleak-test.c	…
kmemleak.c	kmemleak: add config to select auto scan	2018-12-28 12:11:51 -08:00
ksm.c	ksm: react on changing "sleep_millisecs" parameter faster	2018-12-28 12:11:51 -08:00
list_lru.c	…
maccess.c	…
madvise.c	mm/mmu_notifier: use structure for invalidate_range_start/end calls v2	2018-12-28 12:11:50 -08:00
memblock.c	mm/memblock.c: skip kmemleak for kasan_init()	2018-12-28 12:11:49 -08:00
memcontrol.c	memcg, oom: notify on oom killer invocation from the charge path	2018-12-28 12:11:52 -08:00
memfd.c	memfd: Convert memfd_tag_pins to XArray	2018-10-21 10:46:41 -04:00
memory-failure.c	hugetlbfs: revert "use i_mmap_rwsem for more pmd sharing synchronization"	2019-01-08 17:15:11 -08:00
memory.c	mm/memory.c: initialise mmu_notifier_range correctly	2019-01-08 17:15:11 -08:00
memory_hotplug.c	mm, memory_hotplug: deobfuscate migration part of offlining	2018-12-28 12:11:50 -08:00
mempolicy.c	Revert "mm, thp: consolidate THP gfp handling into alloc_hugepage_direct_gfpmask"	2018-12-08 10:26:20 -08:00
mempool.c	…
memtest.c	…
migrate.c	hugetlbfs: revert "use i_mmap_rwsem for more pmd sharing synchronization"	2019-01-08 17:15:11 -08:00
mincore.c	Change mincore() to count "mapped" pages rather than "cached" pages	2019-01-06 13:43:02 -08:00
mlock.c	…
mm_init.c	mm: convert totalram_pages and totalhigh_pages variables to atomic	2018-12-28 12:11:47 -08:00
mmap.c	mm/mmap.c: remove verify_mm_writelocked()	2018-12-28 12:11:47 -08:00
mmu_context.c	…
mmu_gather.c	mm: Replace call_rcu_sched() with call_rcu()	2018-11-27 09:21:46 -08:00
mmu_notifier.c	mm/mmu_notifier: use structure for invalidate_range_start/end calls v2	2018-12-28 12:11:50 -08:00
mmzone.c	…
mprotect.c	mm/mmu_notifier: use structure for invalidate_range_start/end calls v2	2018-12-28 12:11:50 -08:00
mremap.c	mm: speed up mremap by 20x on large regions	2019-01-04 13:13:48 -08:00
msync.c	…
nommu.c	mm/gup: cache dev_pagemap while pinning pages	2018-10-26 16:38:15 -07:00
oom_kill.c	mm/mmu_notifier: use structure for invalidate_range_start/end calls v2	2018-12-28 12:11:50 -08:00
page-writeback.c	mm/page-writeback.c: don't break integrity writeback on ->writepage() error	2018-12-28 12:11:49 -08:00
page_alloc.c	mm, page_alloc: do not wake kswapd with zone lock held	2019-01-08 17:15:11 -08:00
page_counter.c	…
page_ext.c	mm: remove include/linux/bootmem.h	2018-10-31 08:54:16 -07:00
page_idle.c	mm: remove include/linux/bootmem.h	2018-10-31 08:54:16 -07:00
page_io.c	mm/page_io.c: fix polled swap page in	2019-01-04 13:13:48 -08:00
page_isolation.c	mm: only report isolation failures when offlining memory	2018-12-28 12:11:46 -08:00
page_owner.c	mm/page_owner: clamp read count to PAGE_SIZE	2018-12-28 12:11:46 -08:00
page_poison.c	virtio, vhost: fixes, tweaks	2018-11-01 14:42:49 -07:00
page_vma_mapped.c	mm/rmap: map_pte() was not handling private ZONE_DEVICE page properly	2018-10-31 08:54:11 -07:00
pagewalk.c	…
percpu-internal.h	…
percpu-km.c	percpu: convert spin_lock_irq to spin_lock_irqsave.	2018-12-18 09:04:08 -08:00
percpu-stats.c	…
percpu-vm.c	…
percpu.c	Merge branch 'for-4.20' of git://git.kernel.org/pub/scm/linux/kernel/git/dennis/percpu	2018-11-01 09:27:57 -07:00
pgtable-generic.c	x86/mm: Page size aware flush_tlb_mm_range()	2018-10-09 16:51:11 +02:00
process_vm_access.c	…
quicklist.c	…
readahead.c	mm/readahead.c: simplify get_next_ra_size()	2018-12-28 12:11:46 -08:00
rmap.c	mm/mmu_notifier: mm/rmap.c: Fix a mmu_notifier range bug in try_to_unmap_one	2019-01-10 02:58:21 -08:00
rodata_test.c	…
shmem.c	mm: convert totalram_pages and totalhigh_pages variables to atomic	2018-12-28 12:11:47 -08:00
slab.c	slab: alien caches must not be initialized if the allocation of the alien cache failed	2019-01-08 17:15:11 -08:00
slab.h	kasan, mm: change hooks signatures	2018-12-28 12:11:43 -08:00
slab_common.c	A fairly normal cycle for documentation stuff. We have a new	2018-12-29 11:21:49 -08:00
slob.c	…
slub.c	kasan: make tag based mode work with CONFIG_HARDENED_USERCOPY	2019-01-08 17:15:11 -08:00
sparse-vmemmap.c	mm: remove include/linux/bootmem.h	2018-10-31 08:54:16 -07:00
sparse.c	mm, sparse: pass nid instead of pgdat to sparse_add_one_section()	2018-12-28 12:11:49 -08:00
swap.c	fs: don't open code lru_to_page()	2019-01-04 13:13:48 -08:00
swap_cgroup.c	…
swap_slots.c	…
swap_state.c	Merge branch 'xarray' of git://git.infradead.org/users/willy/linux-dax	2018-10-28 11:35:40 -07:00
swapfile.c	mm, swap: fix swapoff with KSM pages	2018-12-28 12:11:52 -08:00
truncate.c	mm: cleancache: fix corruption on missed inode invalidation	2018-11-30 14:56:14 -08:00
usercopy.c	mm/usercopy.c: no check page span for stack objects	2019-01-08 17:15:11 -08:00
userfaultfd.c	hugetlbfs: revert "use i_mmap_rwsem for more pmd sharing synchronization"	2019-01-08 17:15:11 -08:00
util.c	mm: page_mapped: don't assume compound page is huge or THP	2019-01-08 17:15:11 -08:00
vmacache.c	…
vmalloc.c	mm: convert totalram_pages and totalhigh_pages variables to atomic	2018-12-28 12:11:47 -08:00
vmpressure.c	…
vmscan.c	mm: put_and_wait_on_page_locked() while page is migrated	2018-12-28 12:11:48 -08:00
vmstat.c	mm: convert zone->managed_pages to atomic variable	2018-12-28 12:11:47 -08:00
workingset.c	mm: convert totalram_pages and totalhigh_pages variables to atomic	2018-12-28 12:11:47 -08:00
z3fold.c	z3fold: fix possible reclaim races	2018-11-18 10:15:09 -08:00
zbud.c	…
zpool.c	…
zsmalloc.c	mm/zsmalloc.c: fix fall-through annotation	2018-10-26 16:26:35 -07:00
zswap.c	mm: convert totalram_pages and totalhigh_pages variables to atomic	2018-12-28 12:11:47 -08:00