diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2022-05-08 20:28:22 +0300 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2022-05-08 20:28:22 +0300 |
| commit | 1f8c5dff000d96b66273a0bf57dbf4d505c730cc (patch) | |
| tree | 41ae341690989c890e4ebf59405f199687ffbb30 | |
| parent | 379c72654524d97081f8810a0e4284a16f78a25e (diff) | |
| parent | 2667ed10d9f01e250ba806276740782c89d77fda (diff) | |
| download | linux-1f8c5dff000d96b66273a0bf57dbf4d505c730cc.tar.xz | |
Merge tag 'core-urgent-2022-05-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull PASID fix from Thomas Gleixner:
"A single bugfix for the PASID management code, which freed the PASID
too early. The PASID needs to be tied to the mm lifetime, not to the
address space lifetime"
* tag 'core-urgent-2022-05-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
mm: Fix PASID use-after-free issue
| -rw-r--r-- | kernel/fork.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/kernel/fork.c b/kernel/fork.c index 9796897560ab..35a3beff140b 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -792,6 +792,7 @@ void __mmdrop(struct mm_struct *mm) mmu_notifier_subscriptions_destroy(mm); check_mm(mm); put_user_ns(mm->user_ns); + mm_pasid_drop(mm); free_mm(mm); } EXPORT_SYMBOL_GPL(__mmdrop); @@ -1190,7 +1191,6 @@ static inline void __mmput(struct mm_struct *mm) } if (mm->binfmt) module_put(mm->binfmt->module); - mm_pasid_drop(mm); mmdrop(mm); } |