| From | Greg Kroah-Hartman <> | Subject | [ 66/68] mm: Hold a file reference in madvise_remove | Date | Thu, 12 Jul 2012 16:02:40 -0700 |
| |
From: Greg KH <gregkh@linuxfoundation.org>
3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Lutomirski <luto@amacapital.net>
commit 9ab4233dd08036fe34a89c7dc6f47a8bf2eb29eb upstream.
Otherwise the code races with munmap (causing a use-after-free of the vma) or with close (causing a use-after-free of the struct file).
The bug was introduced by commit 90ed52ebe481 ("[PATCH] holepunch: fix mmap_sem i_mutex deadlock")
[bwh: Backported to 3.2: - Adjust context - madvise_remove() calls vmtruncate_range(), not do_fallocate()] [luto: Backported to 3.0: Adjust context]
|