ARM: missing ->mmap_sem around find_vma() in swp_emulate.c

find_vma() is *not* safe when somebody else is removing vmas.  Not just
the return value might get bogus just as you are getting it (this instance
doesn't try to dereference the resulting vma), the search itself can get
buggered in rather spectacular ways.  IOW, ->mmap_sem really, really is
not optional here.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Cc: <stable@vger.kernel.org>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

diff --git a/arch/arm/kernel/swp_emulate.c b/arch/arm/kernel/swp_emulate.c
index df745188f5de4abdf3bd04faaa5d31b653b0f210..ab1017bd1667d9772e01a903099aa665b3f86b7d 100644 (file)
--- a/arch/arm/kernel/swp_emulate.c
+++ b/arch/arm/kernel/swp_emulate.c
@@ -109,10 +109,12 @@ static void set_segfault(struct pt_regs *regs, unsigned long addr)
 {
        siginfo_t info;
 
+       down_read(&current->mm->mmap_sem);
        if (find_vma(current->mm, addr) == NULL)
                info.si_code = SEGV_MAPERR;
        else
                info.si_code = SEGV_ACCERR;
+       up_read(&current->mm->mmap_sem);
 
        info.si_signo = SIGSEGV;
        info.si_errno = 0;