Fix OOPS in mmap_region() when merging adjacent VM_LOCKED file segments

This patch differs from the upstream commit
de33c8db5910cda599899dd431cc30d7c1018cbf written by Linus, as it aims to
only prevent the oops from happening, not attempt to change anything
else.

The problem was introduced by commit
ba470de43188cdbff795b5da43a1474523c6c2fb

which added new references to *vma after we've potentially freed it.

From: Andrew Morton <akpm@linux-foundation.org>
Reported-by: Maksim Yevmenkin <maksim.yevmenkin@gmail.com>
Tested-by: Maksim Yevmenkin <maksim.yevmenkin@gmail.com>
Cc: Lee Schermerhorn <Lee.Schermerhorn@hp.com>
Cc: Nick Piggin <npiggin@suse.de>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Rik van Riel <riel@redhat.com>
Cc: Hugh Dickins <hugh@veritas.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

diff --git a/mm/mmap.c b/mm/mmap.c
index 937b44f0aac37fedc18de8e4c4a9735aa35effc4..9c3f4f82a46eeca050ada1ae3e9050cdfd335093 100644 (file)
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -1095,6 +1095,7 @@ unsigned long mmap_region(struct file *file, unsigned long addr,
 {
        struct mm_struct *mm = current->mm;
        struct vm_area_struct *vma, *prev;
+       struct vm_area_struct *merged_vma;
        int correct_wcount = 0;
        int error;
        struct rb_node **rb_link, *rb_parent;
@@ -1207,13 +1208,17 @@ munmap_back:
        if (vma_wants_writenotify(vma))
                vma->vm_page_prot = vm_get_page_prot(vm_flags & ~VM_SHARED);
 
-       if (file && vma_merge(mm, prev, addr, vma->vm_end,
-                       vma->vm_flags, NULL, file, pgoff, vma_policy(vma))) {
+       merged_vma = NULL;
+       if (file)
+               merged_vma = vma_merge(mm, prev, addr, vma->vm_end,
+                       vma->vm_flags, NULL, file, pgoff, vma_policy(vma));
+       if (merged_vma) {
                mpol_put(vma_policy(vma));
                kmem_cache_free(vm_area_cachep, vma);
                fput(file);
                if (vm_flags & VM_EXECUTABLE)
                        removed_exe_file_vma(mm);
+               vma = merged_vma;
        } else {
                vma_link(mm, vma, prev, rb_link, rb_parent);
                file = vma->vm_file;