Andy Lutomirski 9b92440f0c mm: Hold a file reference in madvise_remove ...

commit 9ab4233dd08036fe34a89c7dc6f47a8bf2eb29eb upstream.

Otherwise the code races with munmap (causing a use-after-free
of the vma) or with close (causing a use-after-free of the struct
file).

The bug was introduced by commit 90ed52ebe4 ("[PATCH] holepunch: fix
mmap_sem i_mutex deadlock")

Cc: Hugh Dickins <hugh@veritas.com>
Cc: Miklos Szeredi <mszeredi@suse.cz>
Cc: Badari Pulavarty <pbadari@us.ibm.com>
Cc: Nick Piggin <npiggin@suse.de>
Signed-off-by: Andy Lutomirski <luto@amacapital.net>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[bwh: Backported to 3.2:
 - Adjust context
 - madvise_remove() calls vmtruncate_range(), not do_fallocate()]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: David Ng <dave@codeaurora.org>

2012-12-21 09:33:42 -08:00

..

backing-dev.c

bdi: use deferable timer for sync_supers task

2012-07-16 10:48:42 +05:30

bootmem.c

bootmem/sparsemem: remove limit constraint in alloc_bootmem_section

2012-03-21 17:54:58 -07:00

bounce.c

…

cleancache.c

…

compaction.c

mm: mmzone: MIGRATE_CMA migration type added

2012-06-26 10:32:20 -07:00

debug-pagealloc.c

…

dmapool.c

…

fadvise.c

…

failslab.c

…

filemap_xip.c

…

filemap.c

mm: Don't use CMA pages for writes

2012-12-11 10:08:45 -08:00

fremap.c

…

highmem.c

…

huge_memory.c

…

hugetlb.c

hugetlb: prevent BUG_ON in hugetlb_fault() -> hugetlb_cow()

2012-05-10 15:06:44 -07:00

hwpoison-inject.c

…

init-mm.c

…

internal.h

mm: compaction: export some of the functions

2012-06-26 10:32:20 -07:00

Kconfig

kernel: Add hooks for user-accessible timers in the kernel.

2012-11-15 10:03:53 -05:00

Kconfig.debug

…

kmemcheck.c

…

kmemleak-test.c

…

kmemleak.c

…

ksm.c

ksm: cleanup: introduce find_mergeable_vma()

2012-03-21 17:54:59 -07:00

maccess.c

…

madvise.c

mm: Hold a file reference in madvise_remove

2012-12-21 09:33:42 -08:00

Makefile

mm: compaction: export some of the functions

2012-06-26 10:32:20 -07:00

memblock.c

Merge commit 'AU_LINUX_ANDROID_ICS.04.00.04.00.126' into msm-3.4

2012-06-06 18:45:28 -07:00

memcontrol.c

memcg,thp: fix res_counter:96 regression

2012-05-19 10:10:27 -07:00

memory_hotplug.c

mm: page_isolation: MIGRATE_CMA isolation functions added

2012-06-29 16:06:48 -07:00

memory-failure.c

mm: page_isolation: MIGRATE_CMA isolation functions added

2012-06-29 16:06:48 -07:00

memory.c

mm: Use correct define for CMA features

2012-12-17 18:33:37 -08:00

mempolicy.c

mm: fix NULL ptr dereference in migrate_pages

2012-04-25 21:26:34 -07:00

mempool.c

…

migrate.c

mm: fix NULL ptr dereference in move_pages

2012-04-25 21:26:34 -07:00

mincore.c

…

mlock.c

kernel: Add hooks for user-accessible timers in the kernel.

2012-11-15 10:03:53 -05:00

mm_init.c

…

mmap.c

kill mm argument of vm_munmap()

2012-04-21 01:58:20 -04:00

mmu_context.c

mm, counters: remove task argument to sync_mm_rss() and __sync_task_rss_stat()

2012-03-21 17:54:59 -07:00

mmu_notifier.c

…

mmzone.c

…

mprotect.c

Merge branch 'akpm' (Andrew's patch-bomb)

2012-03-22 09:04:48 -07:00

mremap.c

…

msync.c

…

nobootmem.c

mm: nobootmem: fix sign extend problem in __free_pages_memory()

2012-05-10 15:06:44 -07:00

nommu.c

kill mm argument of vm_munmap()

2012-04-21 01:58:20 -04:00

oom_kill.c

signal: oom_kill_task: use SEND_SIG_FORCED instead of force_sig()

2012-03-23 16:58:41 -07:00

page_alloc.c

android/lowmemorykiller: Only consider gfp_mask free pages

2012-12-17 17:23:52 -08:00

page_cgroup.c

…

page_io.c

…

page_isolation.c

mm: page_isolation: MIGRATE_CMA isolation functions added

2012-06-29 16:06:48 -07:00

page-writeback.c

Merge tag 'ext4_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4

2012-03-28 10:02:55 -07:00

pagewalk.c

…

percpu-km.c

…

percpu-vm.c

…

percpu.c

kmemleak: Fix the kmemleak tracking of the percpu areas with !SMP

2012-05-09 10:13:29 -07:00

pgtable-generic.c

thp: add HPAGE_PMD_* definitions for !CONFIG_TRANSPARENT_HUGEPAGE

2012-03-21 17:55:02 -07:00

prio_tree.c

…

process_vm_access.c

…

quicklist.c

…

readahead.c

…

rmap.c

memcg: use new logic for page stat accounting

2012-03-21 17:55:01 -07:00

shmem.c

ashmem: Add shmem_set_file to mm/shmem.c

2012-04-09 13:53:14 -07:00

slab.c

Merge branch 'slab/for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/penberg/linux

2012-03-28 15:04:26 -07:00

slob.c

…

slub.c

slub: missing test for partial pages flush work in flush_all()

2012-05-17 18:00:51 -07:00

sparse-vmemmap.c

…

sparse.c

Merge commit 'AU_LINUX_ANDROID_ICS.04.00.04.00.126' into msm-3.4

2012-06-06 18:45:28 -07:00

swap_state.c

mm: fix s390 BUG by __set_page_dirty_no_writeback on swap

2012-04-23 18:19:22 -07:00

swap.c

…

swapfile.c

swapon: check validity of swap_flags

2012-03-28 17:14:35 -07:00

thrash.c

…

truncate.c

mm for fs: add truncate_pagecache_range()

2012-03-28 17:14:35 -07:00

util.c

…

vmalloc.c

mm: fix faulty initialization in vmalloc_init()

2012-06-06 19:01:38 -07:00

vmscan.c

mm: fix up the vmscan stat in vmstat

2012-04-25 21:26:33 -07:00

vmstat.c

mm: make counts of CMA free pages correct

2012-12-17 14:48:27 -08:00