tree 215794f8822955eac1588ce9d62ec7c804b7e009
parent 8b4e389296c5ed5e3a3c5c3fc0a6bc9fafd3d26b
author Barret Rhoden <brho@cs.berkeley.edu> 1573064725 -0500
committer Barret Rhoden <brho@cs.berkeley.edu> 1573065812 -0500

Unmap pages mapped during a failed fill_vmr()

If we get part of the way through filling the VMR with the parent's
contents, but then run out of memory, we were leaving the old,
successful PTE mappings behind.  The VMR would be freed and never
added to the proc's list, so we wouldn't unmap it during __proc_free().
However, our assert would catch that the process still has mapped pages
that weren't a part of any VMR.

I'm not 100% that this is what happened with syzkaller, but it's a
likely scenario, especially since other bugs it found recently are due
to running low/out of memory.

Reported-by: syzbot+28ec6ca66d7b660fbf4d@syzkaller.appspotmail.com

Signed-off-by: Barret Rhoden <brho@cs.berkeley.edu>