[lkml]   [2012]   [Jul]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    Subject[ 66/68] mm: Hold a file reference in madvise_remove
    From: Greg KH <>

    3.0-stable review patch. If anyone has any objections, please let me know.


    From: Andy Lutomirski <>

    commit 9ab4233dd08036fe34a89c7dc6f47a8bf2eb29eb upstream.

    Otherwise the code races with munmap (causing a use-after-free
    of the vma) or with close (causing a use-after-free of the struct

    The bug was introduced by commit 90ed52ebe481 ("[PATCH] holepunch: fix
    mmap_sem i_mutex deadlock")

    [bwh: Backported to 3.2:
    - Adjust context
    - madvise_remove() calls vmtruncate_range(), not do_fallocate()]
    [luto: Backported to 3.0: Adjust context]

     \ /
      Last update: 2012-07-13 05:43    [W:0.023 / U:63.964 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site