Fix for BUG_ON(anon_vma->degree) splashes in unlink_anon_vmas() ("kernel
BUG at mm/rmap.c:399!") caused by commit 7a3ef208e6 ("mm: prevent
endless growth of anon_vma hierarchy")
Anon_vma_clone() is usually called for a copy of source vma in
destination argument. If source vma has anon_vma it should be already
in dst->anon_vma. NULL in dst->anon_vma is used as a sign that it's
called from anon_vma_fork(). In this case anon_vma_clone() finds
anon_vma for reusing.
Vma_adjust() calls it differently and this breaks anon_vma reusing
logic: anon_vma_clone() links vma to old anon_vma and updates degree
counters but vma_adjust() overrides vma->anon_vma right after that. As
a result final unlink_anon_vmas() decrements degree for wrong anon_vma.
This patch assigns ->anon_vma before calling anon_vma_clone().
Signed-off-by: Konstantin Khlebnikov <[email protected]>
Reported-and-tested-by: Chris Clayton <[email protected]>
Reported-and-tested-by: Oded Gabbay <[email protected]>
Reported-and-tested-by: Chih-Wei Huang <[email protected]>
Acked-by: Rik van Riel <[email protected]>
Acked-by: Vlastimil Babka <[email protected]>
Cc: Daniel Forrest <[email protected]>
Cc: Michal Hocko <[email protected]>
Cc: [email protected] # to match back-porting of 7a3ef208e6
Signed-off-by: Linus Torvalds <[email protected]>
Konstantin Khlebnikov
b800c91a05