lkml.org 
[lkml]   [2012]   [Jul]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    Subject[ 66/68] mm: Hold a file reference in madvise_remove
    Date
    From: Greg KH <gregkh@linuxfoundation.org>

    3.0-stable review patch. If anyone has any objections, please let me know.

    ------------------

    From: Andy Lutomirski <luto@amacapital.net>

    commit 9ab4233dd08036fe34a89c7dc6f47a8bf2eb29eb upstream.

    Otherwise the code races with munmap (causing a use-after-free
    of the vma) or with close (causing a use-after-free of the struct
    file).

    The bug was introduced by commit 90ed52ebe481 ("[PATCH] holepunch: fix
    mmap_sem i_mutex deadlock")

    [bwh: Backported to 3.2:
    - Adjust context
    - madvise_remove() calls vmtruncate_range(), not do_fallocate()]
    [luto: Backported to 3.0: Adjust context]



    \
     
     \ /
      Last update: 2012-07-13 05:43    [W:0.024 / U:60.808 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site