mm: fix prctl_set_vma_anon_name

prctl_set_vma_anon_name could attempt to set the name across
two vmas at the same time due to a typo, which might corrupt
the vma list.  Fix it to use tmp instead of end to limit
the name setting to a single vma at a time.

Change-Id:I8dc2353f32b5f8510986d01c5f27d450b645902a
Reported-by: Jed Davis <jld@mozilla.com>
Signed-off-by: Colin Cross <ccross@android.com>
Git-commit: 9bc0c15675840178cee1486c2a7f25faead1518e
Git-Repo: https://android.googlesource.com/kernel/common.git
Signed-off-by: Vinayak Menon <vinmenon@codeaurora.org>
This commit is contained in:
Colin Cross
2016-05-30 01:13:57 -07:00
committed by Gerrit - the friendly Code Review server
parent b405b92f3b
commit f2e58c0fe1
+1 -1
View File
@@ -1909,7 +1909,7 @@ static int prctl_set_vma_anon_name(unsigned long start, unsigned long end,
tmp = end;
/* Here vma->vm_start <= start < tmp <= (end|vma->vm_end). */
error = prctl_update_vma_anon_name(vma, &prev, start, end,
error = prctl_update_vma_anon_name(vma, &prev, start, tmp,
(const char __user *)arg);
if (error)
return error;