Re: [PATCH v2] mm: rmap: fix use-after-free in __put_anon_vma

2014-06-07 Thread David Rientjes
On Fri, 6 Jun 2014, Andrey Ryabinin wrote: > While working address sanitizer for kernel I've discovered use-after-free > bug in __put_anon_vma. > For the last anon_vma, anon_vma->root freed before child anon_vma. > Later in anon_vma_free(anon_vma) we are referencing to already freed > anon_vma->r

Re: [PATCH v2] mm: rmap: fix use-after-free in __put_anon_vma

2014-06-06 Thread Peter Zijlstra
On Fri, Jun 06, 2014 at 07:09:30PM +0400, Andrey Ryabinin wrote: > While working address sanitizer for kernel I've discovered use-after-free > bug in __put_anon_vma. > For the last anon_vma, anon_vma->root freed before child anon_vma. > Later in anon_vma_free(anon_vma) we are referencing to already

[PATCH v2] mm: rmap: fix use-after-free in __put_anon_vma

2014-06-06 Thread Andrey Ryabinin
While working address sanitizer for kernel I've discovered use-after-free bug in __put_anon_vma. For the last anon_vma, anon_vma->root freed before child anon_vma. Later in anon_vma_free(anon_vma) we are referencing to already freed anon_vma->root to check rwsem. This patch puts freeing of child a