CVE-2022-42703 (C, published 2022-10-09T23:15Z)
Description: value: mm/rmap.c in the Linux kernel before 5.19.7 has a use-after-free related to leaf anon_vma double reuse.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/torvalds/linux
Files changed:
include/linux/rmap.h
mm/rmap.c
Commit message: mm/rmap: Fix anon_vma->degree ambiguity leading to double-reuse

anon_vma->degree tracks the combined number of child anon_vmas and VMAs
that use the anon_vma as their ->anon_vma.

anon_vma_clone() then assumes that for any anon_vma attached to
src->anon_vma_chain other than src->anon_vma, it is impossible for it to
be a leaf node of the VMA tree, meaning that for such VMAs ->degree is
elevated by 1 because of a child anon_vma, meaning that if ->degree
equals 1 there are no VMAs that use the anon_vma as their ->anon_vma.

This assumption is wrong because the ->degree optimization leads to leaf
nodes being abandoned on anon_vma_clone() - an existing anon_vma is
reused and no new parent-child relationship is created.  So it is
possible to reuse an anon_vma for one VMA while it is still tied to
another VMA.

This is an issue because is_mergeable_anon_vma() and its callers assume
that if two VMAs have the same ->anon_vma, the list of anon_vmas
attached to the VMAs is guaranteed to be the same.  When this assumption
is violated, vma_merge() can merge pages into a VMA that is not attached
to the corresponding anon_vma, leading to dangling page->mapping
pointers that will be dereferenced during rmap walks.

Fix it by separately tracking the number of child anon_vmas and the
number of VMAs using the anon_vma as their ->anon_vma.

Fixes: 7a3ef208e662 ("mm: prevent endless growth of anon_vma hierarchy")
Cc: stable@kernel.org
Acked-by: Michal Hocko <mhocko@suse.com>
Acked-by: Vlastimil Babka <vbabka@suse.cz>
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>


Vulnerable code:
	 * Count of child anon_vmas and VMAs which points to this anon_vma.
	unsigned degree;
		anon_vma->degree = 1;	/* Reference for first vma */
		/* vma reference or self-parent link for new root */
		anon_vma->degree++;
		 * Reuse existing anon_vma if its degree lower than two,
		 * that means it has no vma and only one anon_vma child.
		 * Do not choose parent anon_vma, otherwise first child
		 * will always reuse it. Root anon_vma is never reused:
		    anon_vma != src->anon_vma && anon_vma->degree < 2)
		dst->anon_vma->degree++;
	anon_vma->parent->degree++;
			anon_vma->parent->degree--;
		vma->anon_vma->degree--;
		VM_WARN_ON(anon_vma->degree);

Fixed code:
	 * Count of child anon_vmas. Equals to the count of all anon_vmas that
	 * have ->parent pointing to this one, including itself.
	unsigned long num_children;
	/* Count of VMAs whose ->anon_vma pointer points to this object. */
	unsigned long num_active_vmas;
		anon_vma->num_children = 0;
		anon_vma->num_active_vmas = 0;
		anon_vma->num_children++; /* self-parent link for new root */
		anon_vma->num_active_vmas++;
		 * Reuse existing anon_vma if it has no vma and only one
		 * anon_vma child.
		 * Root anon_vma is never reused:
		    anon_vma->num_children < 2 &&
		    anon_vma->num_active_vmas == 0)
		dst->anon_vma->num_active_vmas++;
	anon_vma->num_active_vmas++;
	anon_vma->parent->num_children++;
			anon_vma->parent->num_children--;
		vma->anon_vma->num_active_vmas--;
		VM_WARN_ON(anon_vma->num_children);
		VM_WARN_ON(anon_vma->num_active_vmas);