diff options
| author | Lorenzo Stoakes <[email protected]> | 2024-12-06 21:52:29 +0000 |
|---|---|---|
| committer | Andrew Morton <[email protected]> | 2024-12-19 03:04:42 +0000 |
| commit | 42c4e4b20d9c4651903c4afc53a4ff18b7451b3e (patch) | |
| tree | f082a9bd61542e14059ab30d12a59adbbcc20979 /drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c | |
| parent | mm: use aligned address in copy_user_gigantic_page() (diff) | |
| download | kernel-42c4e4b20d9c4651903c4afc53a4ff18b7451b3e.tar.gz kernel-42c4e4b20d9c4651903c4afc53a4ff18b7451b3e.zip | |
mm: correctly reference merged VMA
On second merge attempt on mmap() we incorrectly discard the possibly
merged VMA, resulting in a possible use-after-free (and most certainly a
reference to the wrong VMA) in this instance in the subsequent
__mmap_complete() invocation.
Correct this mistake by reassigning vma correctly if a merge succeeds in
this case.
Link: https://lkml.kernel.org/r/[email protected]
Fixes: 5ac87a885aec ("mm: defer second attempt at merge on mmap()")
Signed-off-by: Lorenzo Stoakes <[email protected]>
Suggested-by: Jann Horn <[email protected]>
Reported-by: [email protected]
Closes: https://lore.kernel.org/all/[email protected]/
Reviewed-by: Liam R. Howlett <[email protected]>
Reviewed-by: Vlastimil Babka <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Diffstat (limited to 'drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c')
0 files changed, 0 insertions, 0 deletions