Re: [PATCH 6.2.y] mm/mempolicy: fix use-after-free of VMA iterator

[Greg KH <greg@kroah.com>]

On Mon, Apr 24, 2023 at 11:31:08AM -0400, Liam R. Howlett wrote:
> [ Upstream commit f4e9e0e69468583c2c6d9d5c7bfc975e292bf188 ]
> 
> set_mempolicy_home_node() iterates over a list of VMAs and calls
> mbind_range() on each VMA, which also iterates over the singular list of
> the VMA passed in and potentially splits the VMA.  Since the VMA iterator
> is not passed through, set_mempolicy_home_node() may now point to a stale
> node in the VMA tree.  This can result in a UAF as reported by syzbot.
> 
> Avoid the stale maple tree node by passing the VMA iterator through to the
> underlying call to split_vma().
> 
> mbind_range() is also overly complicated, since there are two calling
> functions and one already handles iterating over the VMAs.  Simplify
> mbind_range() to only handle merging and splitting of the VMAs.
> 
> Align the new loop in do_mbind() and existing loop in
> set_mempolicy_home_node() to use the reduced mbind_range() function.  This
> allows for a single location of the range calculation and avoids
> constantly looking up the previous VMA (since this is a loop over the
> VMAs).
> 
> Link: https://lore.kernel.org/linux-mm/000000000000c93feb05f87e24ad@google.com/
> Fixes: 66850be55e8e ("mm/mempolicy: use vma iterator & maple state instead of vma linked list")
> Signed-off-by: Liam R. Howlett <Liam.Howlett@oracle.com>
> Reported-by: syzbot+a7c1ec5b1d71ceaa5186@syzkaller.appspotmail.com
>   Link: https://lkml.kernel.org/r/20230410152205.2294819-1-Liam.Howlett@oracle.com
> Tested-by: syzbot+a7c1ec5b1d71ceaa5186@syzkaller.appspotmail.com
> Cc: <stable@vger.kernel.org>
> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
> (cherry picked from commit f4e9e0e69468583c2c6d9d5c7bfc975e292bf188)
> Signed-off-by: Liam R. Howlett <Liam.Howlett@oracle.com>
> (cherry picked from commit 905e8727c6aca577a8151105a6e0912591649690)

There is no such commit in Linus's tree.  Please be more careful in the
future...