diff options
| author | Nicholas Piggin <npiggin@gmail.com> | 2023-06-07 13:10:24 +0300 |
|---|---|---|
| committer | Michael Ellerman <mpe@ellerman.id.au> | 2023-06-15 07:04:19 +0300 |
| commit | b4bda59b47879cce38a6ec5a01cd3cac702b5331 (patch) | |
| tree | 1eabf59f11b9e2051ea04d09304ec7dc98eef186 /arch/powerpc/platforms/powernv | |
| parent | 27be2456332dcd69907f086cda327ad923b222cf (diff) | |
| download | linux-b4bda59b47879cce38a6ec5a01cd3cac702b5331.tar.xz | |
powerpc/64s: Fix VAS mm use after free
The refcount on mm is dropped before the coprocessor is detached.
Reported-by: Sachin Sant <sachinp@linux.ibm.com>
Fixes: 7bc6f71bdff5f ("powerpc/vas: Define and use common vas_window struct")
Fixes: b22f2d88e435c ("powerpc/pseries/vas: Integrate API with open/close windows")
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Tested-by: Sachin Sant <sachinp@linux.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://msgid.link/20230607101024.14559-1-npiggin@gmail.com
Diffstat (limited to 'arch/powerpc/platforms/powernv')
| -rw-r--r-- | arch/powerpc/platforms/powernv/vas-window.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/arch/powerpc/platforms/powernv/vas-window.c b/arch/powerpc/platforms/powernv/vas-window.c index 0072682531d8..b664838008c1 100644 --- a/arch/powerpc/platforms/powernv/vas-window.c +++ b/arch/powerpc/platforms/powernv/vas-window.c @@ -1310,8 +1310,8 @@ int vas_win_close(struct vas_window *vwin) /* if send window, drop reference to matching receive window */ if (window->tx_win) { if (window->user_win) { - put_vas_user_win_ref(&vwin->task_ref); mm_context_remove_vas_window(vwin->task_ref.mm); + put_vas_user_win_ref(&vwin->task_ref); } put_rx_win(window->rxwin); } |