mm: fix corner case in anon_vma endless growing prevention

Fix for BUG_ON(anon_vma->degree) splashes in unlink_anon_vmas() ("kernel
BUG at mm/rmap.c:399!") caused by commit 7a3ef208e662 ("mm: prevent
endless growth of anon_vma hierarchy")

Anon_vma_clone() is usually called for a copy of source vma in
destination argument.  If source vma has anon_vma it should be already
in dst->anon_vma.  NULL in dst->anon_vma is used as a sign that it's
called from anon_vma_fork().  In this case anon_vma_clone() finds
anon_vma for reusing.

Vma_adjust() calls it differently and this breaks anon_vma reusing
logic: anon_vma_clone() links vma to old anon_vma and updates degree
counters but vma_adjust() overrides vma->anon_vma right after that.  As
a result final unlink_anon_vmas() decrements degree for wrong anon_vma.

This patch assigns ->anon_vma before calling anon_vma_clone().

Signed-off-by: Konstantin Khlebnikov <[email protected]>
Reported-and-tested-by: Chris Clayton <[email protected]>
Reported-and-tested-by: Oded Gabbay <[email protected]>
Reported-and-tested-by: Chih-Wei Huang <[email protected]>
Acked-by: Rik van Riel <[email protected]>
Acked-by: Vlastimil Babka <[email protected]>
Cc: Daniel Forrest <[email protected]>
Cc: Michal Hocko <[email protected]>
Cc: [email protected]  # to match back-porting of 7a3ef208e662
Signed-off-by: Linus Torvalds <[email protected]>

0 files changed, 0 insertions, 0 deletions