Messages in this thread | | | Date | Fri, 13 Dec 2013 10:24:27 +0400 | From | Cyrill Gorcunov <> | Subject | Re: [PATCH] mm: fix use-after-free in sys_remap_file_pages |
| |
On Thu, Dec 12, 2013 at 10:41:18PM -0500, Rik van Riel wrote: > > If the vma has been freed by the time the code jumps to the > out label (because it was freed by a function called from > mmap_region), surely it will also already have been freed > by the time this patch dereferences it? > > Also, setting vma = NULL to avoid the if (vma) branch at > the out: label is unnecessarily obfuscated. Lets make things > clear by documenting what is going on, and having a label > after that dereference.
This patch is a bit easier to read, at least for me. And if I understand the code flow right, the issue is due to remap_file_pages -> mmap_region -> find_vma_links -> do_munmap.
| |