mm: remap_file_pages: grab file ref to prevent race while mmaping

A file reference should be held while a file is mmaped, otherwise it might
be freed while being used.

Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
Suggested-by: Hugh Dickins <hughd@google.com>
Acked-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>

diff --git a/mm/mmap.c b/mm/mmap.c
index 2a0e0a8337b60c6299a1e3a0d7d5a37a57fffe2b..da3c2122475724a5c4b55a5bcb6b83626246e577 100644 (file)
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -2593,6 +2593,7 @@ SYSCALL_DEFINE5(remap_file_pages, unsigned long, start, unsigned long, size,
        struct vm_area_struct *vma;
        unsigned long populate = 0;
        unsigned long ret = -EINVAL;
+       struct file *file;
 
        pr_warn_once("%s (%d) uses deprecated remap_file_pages() syscall. "
                        "See Documentation/vm/remap_file_pages.txt.\n",
@@ -2636,8 +2637,10 @@ SYSCALL_DEFINE5(remap_file_pages, unsigned long, start, unsigned long, size,
                munlock_vma_pages_range(vma, start, start + size);
        }
 
+       file = get_file(vma->vm_file);
        ret = do_mmap_pgoff(vma->vm_file, start, size,
                        prot, flags, pgoff, &populate);
+       fput(file);
 out:
        up_write(&mm->mmap_sem);
        if (populate)