From 0a381753d0584ca02532889a5e84c482ecbc1b9a Mon Sep 17 00:00:00 2001 From: "Liam R. Howlett" Date: Wed, 13 Apr 2022 23:07:16 -0700 Subject: [PATCH] mm/mmap: Fix advanced maple tree API for mmap_region() Overwriting next pointer in mmap_region() breaks the error path in a future patch. Signed-off-by: Liam R. Howlett --- mm/mmap.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/mm/mmap.c b/mm/mmap.c index f705e68931ce..9e0c657c265d 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -1765,7 +1765,7 @@ unsigned long mmap_region(struct file *file, unsigned long addr, { struct mm_struct *mm = current->mm; struct vm_area_struct *vma = NULL; - struct vm_area_struct *prev, *next; + struct vm_area_struct *next, *prev, *merge; pgoff_t pglen = len >> PAGE_SHIFT; unsigned long charged = 0; unsigned long end = addr + len; @@ -1883,19 +1883,17 @@ unsigned long mmap_region(struct file *file, unsigned long addr, * as we may succeed this time. */ if (unlikely(vm_flags != vma->vm_flags && prev)) { - next = vma_merge(mm, prev, vma->vm_start, vma->vm_end, vma->vm_flags, + merge = vma_merge(mm, prev, vma->vm_start, vma->vm_end, vma->vm_flags, NULL, vma->vm_file, vma->vm_pgoff, NULL, NULL_VM_UFFD_CTX, NULL); - if (next) { + if (merge) { /* ->mmap() can change vma->vm_file and fput the original file. So * fput the vma->vm_file here or we would add an extra fput for file * and cause general protection fault ultimately. */ fput(vma->vm_file); vm_area_free(vma); - vma = prev; - /* Update vm_flags and possible addr to pick up the change. We don't - * warn here if addr changed as the vma is not linked by vma_link(). - */ + vma = merge; + /* Update vm_flags to pick up the change. */ addr = vma->vm_start; vm_flags = vma->vm_flags; goto unmap_writable; -- 2.35.1