[to-be-updated] mm-rmap-add-anon_vma-lifetime-debug-check.patch removed from -mm tree

[to-be-updated] mm-rmap-add-anon_vma-lifetime-debug-check.patch removed from -mm tree

[Andrew Morton]

The quilt patch titled
     Subject: mm/rmap: add anon_vma lifetime debug check
has been removed from the -mm tree.  Its filename was
     mm-rmap-add-anon_vma-lifetime-debug-check.patch

This patch was dropped because an updated version will be issued

------------------------------------------------------
From: Jann Horn <jannh@google.com>
Subject: mm/rmap: add anon_vma lifetime debug check
Date: Thu, 24 Jul 2025 21:13:50 +0200

If an anon page is mapped into userspace, its anon_vma must be alive,
otherwise rmap walks can hit UAF.

There have been syzkaller reports a few months ago[1][2] of UAF in rmap
walks that seems to indicate that there can be pages with elevated
mapcount whose anon_vma has already been freed, but I think we never
figured out what the cause is; and syzkaller only hit these UAFs when
memory pressure randomly caused reclaim to rmap-walk the affected pages,
so it of course didn't manage to create a reproducer.

Add a VM_WARN_ON_FOLIO() when we add/remove mappings of anonymous pages to
hopefully catch such issues more reliably.

Implementation note: I'm checking IS_ENABLED(CONFIG_DEBUG_VM) because,
unlike the checks above, this one would otherwise be hard to write such
that it completely compiles away in non-debug builds by itself, without
looking extremely ugly.

[akpm@linux-foundation.org: PAGE_MAPPING_ANON became FOLIO_MAPPING_ANON]
Link: https://lkml.kernel.org/r/20250724-anonvma-uaf-debug-v1-1-29989ddc4e2a@google.com
Link: https://lore.kernel.org/r/67abaeaf.050a0220.110943.0041.GAE@google.com [1]
Link: https://lore.kernel.org/r/67a76f33.050a0220.3d72c.0028.GAE@google.com [2]
Signed-off-by: Jann Horn <jannh@google.com>
Cc: David Hildenbrand <david@redhat.com>
Cc: Liam Howlett <liam.howlett@oracle.com>
Cc: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Cc: Rik van Riel <riel@surriel.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 include/linux/rmap.h |   14 ++++++++++++++
 1 file changed, 14 insertions(+)

--- a/include/linux/rmap.h~mm-rmap-add-anon_vma-lifetime-debug-check
+++ a/include/linux/rmap.h
@@ -449,6 +449,20 @@ static inline void __folio_rmap_sanity_c
 	default:
 		VM_WARN_ON_ONCE(true);
 	}
+
+	/*
+	 * Anon folios must have an associated live anon_vma as long as they're
+	 * mapped into userspace.
+	 * Part of the purpose of the atomic_read() is to make KASAN check that
+	 * the anon_vma is still alive.
+	 */
+	if (IS_ENABLED(CONFIG_DEBUG_VM) && PageAnonNotKsm(page)) {
+		unsigned long mapping = (unsigned long)folio->mapping;
+		struct anon_vma *anon_vma;
+
+		anon_vma = (void *)(mapping - FOLIO_MAPPING_ANON);
+		VM_WARN_ON_FOLIO(atomic_read(&anon_vma->refcount) == 0, folio);
+	}
 }
 
 /*
_

Patches currently in -mm which might be from jannh@google.com are

kasan-skip-quarantine-if-object-is-still-accessible-under-rcu.patch