Re: [PATCH] mm: fix use-after-free in sys_remap_file_pages

[Cyrill Gorcunov]

On Thu, Dec 12, 2013 at 10:41:18PM -0500, Rik van Riel wrote:
> 
> If the vma has been freed by the time the code jumps to the
> out label (because it was freed by a function called from
> mmap_region), surely it will also already have been freed
> by the time this patch dereferences it?
> 
> Also, setting vma = NULL to avoid the if (vma) branch at
> the out: label is unnecessarily obfuscated. Lets make things
> clear by documenting what is going on, and having a label
> after that dereference.

This patch is a bit easier to read, at least for me. And if
I understand the code flow right, the issue is due to
remap_file_pages -> mmap_region -> find_vma_links -> do_munmap.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/