diff options
| author | Nicholas Piggin <npiggin@gmail.com> | 2023-06-07 13:10:24 +0300 |
|---|---|---|
| committer | Michael Ellerman <mpe@ellerman.id.au> | 2023-06-15 07:04:19 +0300 |
| commit | b4bda59b47879cce38a6ec5a01cd3cac702b5331 (patch) | |
| tree | 1eabf59f11b9e2051ea04d09304ec7dc98eef186 /arch/powerpc/platforms/pseries | |
| parent | 27be2456332dcd69907f086cda327ad923b222cf (diff) | |
| download | linux-b4bda59b47879cce38a6ec5a01cd3cac702b5331.tar.xz | |
powerpc/64s: Fix VAS mm use after free
The refcount on mm is dropped before the coprocessor is detached.
Reported-by: Sachin Sant <sachinp@linux.ibm.com>
Fixes: 7bc6f71bdff5f ("powerpc/vas: Define and use common vas_window struct")
Fixes: b22f2d88e435c ("powerpc/pseries/vas: Integrate API with open/close windows")
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Tested-by: Sachin Sant <sachinp@linux.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://msgid.link/20230607101024.14559-1-npiggin@gmail.com
Diffstat (limited to 'arch/powerpc/platforms/pseries')
| -rw-r--r-- | arch/powerpc/platforms/pseries/vas.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/arch/powerpc/platforms/pseries/vas.c b/arch/powerpc/platforms/pseries/vas.c index 513180467562..9a44a98ba342 100644 --- a/arch/powerpc/platforms/pseries/vas.c +++ b/arch/powerpc/platforms/pseries/vas.c @@ -507,8 +507,8 @@ static int vas_deallocate_window(struct vas_window *vwin) vascaps[win->win_type].nr_open_windows--; mutex_unlock(&vas_pseries_mutex); - put_vas_user_win_ref(&vwin->task_ref); mm_context_remove_vas_window(vwin->task_ref.mm); + put_vas_user_win_ref(&vwin->task_ref); kfree(win); return 0; |