+ madvise-use-split_vma-instead-of-__split_vma-fix.patch added to mm-unstable branch

+ madvise-use-split_vma-instead-of-__split_vma-fix.patch added to mm-unstable branch

[Andrew Morton]

The patch titled
     Subject: mm/madvise: fix VMA_ITERATOR start position
has been added to the -mm mm-unstable branch.  Its filename is
     madvise-use-split_vma-instead-of-__split_vma-fix.patch

This patch will shortly appear at
     https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patches/madvise-use-split_vma-instead-of-__split_vma-fix.patch

This patch will later appear in the mm-unstable branch at
    git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

Before you just go and hit "reply", please:
   a) Consider who else should be cc'ed
   b) Prefer to cc a suitable mailing list as well
   c) Ideally: find the original patch on the mailing list and do a
      reply-to-all to that, adding suitable additional cc's

*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***

The -mm tree is included into linux-next via the mm-everything
branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there every 2-3 working days

------------------------------------------------------
From: Liam Howlett <Liam.Howlett@oracle.com>
Subject: mm/madvise: fix VMA_ITERATOR start position
Date: Wed, 25 Jan 2023 08:58:09 -0500

The WARN_ON() in vma_iter_store() detected an invalid VMA iterator state. 
Inspecting the code stack from the report shows that the VMA iterator is
never set to the correct start position.

Setting the initialization of the VMA iterator to use the address 'start'
fixes this issue.

Link: https://lkml.kernel.org/r/20230125135809.85262-1-Liam.Howlett@oracle.com
Signed-off-by: Liam Howlett <Liam.Howlett@oracle.com>
Reported-by: <syzbot+1d9ec4d1a334ae9e1ca6@syzkaller.appspotmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---


--- a/mm/madvise.c~madvise-use-split_vma-instead-of-__split_vma-fix
+++ a/mm/madvise.c
@@ -142,7 +142,7 @@ static int madvise_update_vma(struct vm_
 	struct mm_struct *mm = vma->vm_mm;
 	int error;
 	pgoff_t pgoff;
-	VMA_ITERATOR(vmi, mm, 0);
+	VMA_ITERATOR(vmi, mm, start);
 
 	if (new_flags == vma->vm_flags && anon_vma_name_eq(anon_vma_name(vma), anon_name)) {
 		*prev = vma;
_

Patches currently in -mm which might be from Liam.Howlett@oracle.com are

maple_tree-fix-handle-of-invalidated-state-in-mas_wr_store_setup.patch
maple_tree-fix-mas_prev-and-mas_find-state-handling.patch
nommu-pass-through-vma-iterator-to-shrink_vma.patch
mm-damon-vaddr-testh-stop-using-vma_mas_store-for-maple-tree-store.patch
madvise-use-split_vma-instead-of-__split_vma-fix.patch
mm-mremap-convert-vma_adjust-to-vma_expand.patch