diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2024-10-18 19:50:05 +0300 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2024-10-18 19:50:05 +0300 |
| commit | b1b46751671be5a426982f037a47ae05f37ff80b (patch) | |
| tree | ff6532dce8a1a9219bad0726c042dc7e04a91416 | |
| parent | 75aa74d52f43e75d0beb20572f98529071b700e5 (diff) | |
| download | linux-b1b46751671be5a426982f037a47ae05f37ff80b.tar.xz | |
mm: fix follow_pfnmap API lockdep assert
The lockdep asserts for the new follow_pfnmap() API "knows" that a
pfnmap always has a vma->vm_file, since that's the only way to create
such a mapping.
And that's actually true for all the normal cases. But not for the mmap
failure case, where the incomplete mapping is torn down and we have
cleared vma->vm_file because the failure occured before the file was
linked to the vma.
So this codepath does actually need to check for vm_file being NULL.
Reported-by: Jann Horn <jannh@google.com>
Fixes: 6da8e9634bb7 ("mm: new follow_pfnmap API")
Cc: Peter Xu <peterx@redhat.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
| -rw-r--r-- | mm/memory.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/mm/memory.c b/mm/memory.c index 30feedabc932..3ccee51adfbb 100644 --- a/mm/memory.c +++ b/mm/memory.c @@ -6350,7 +6350,8 @@ static inline void pfnmap_args_setup(struct follow_pfnmap_args *args, static inline void pfnmap_lockdep_assert(struct vm_area_struct *vma) { #ifdef CONFIG_LOCKDEP - struct address_space *mapping = vma->vm_file->f_mapping; + struct file *file = vma->vm_file; + struct address_space *mapping = file ? file->f_mapping : NULL; if (mapping) lockdep_assert(lockdep_is_held(&vma->vm_file->f_mapping->i_mmap_rwsem) || |