AppArmor: fix oops in apparmor_setprocattr

[firefly-linux-kernel-4.4.55.git] / mm / rmap.c

diff --git a/mm/rmap.c b/mm/rmap.c
index ba58ca36fc90c9f5b92db256fdd431c1f94ea4f0..0eb463ea88dd71326b70342f8492df873a6b5df1 100644 (file)
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -352,6 +352,11 @@ void __init anon_vma_init(void)
  * The page might have been remapped to a different anon_vma or the anon_vma
  * returned may already be freed (and even reused).
  *
+ * In case it was remapped to a different anon_vma, the new anon_vma will be a
+ * child of the old anon_vma, and the anon_vma lifetime rules will therefore
+ * ensure that any anon_vma obtained from the page will still be valid for as
+ * long as we observe page_mapped() [ hence all those page_mapped() tests ].
+ *
  * All users of this function must be very careful when walking the anon_vma
  * chain and verify that the page in question is indeed mapped in it
  * [ something equivalent to page_mapped_in_vma() ].
@@ -405,6 +410,7 @@ out:
 struct anon_vma *page_lock_anon_vma(struct page *page)
 {
        struct anon_vma *anon_vma = NULL;
+       struct anon_vma *root_anon_vma;
        unsigned long anon_mapping;
 
        rcu_read_lock();
@@ -415,13 +421,15 @@ struct anon_vma *page_lock_anon_vma(struct page *page)
                goto out;
 
        anon_vma = (struct anon_vma *) (anon_mapping - PAGE_MAPPING_ANON);
-       if (mutex_trylock(&anon_vma->root->mutex)) {
+       root_anon_vma = ACCESS_ONCE(anon_vma->root);
+       if (mutex_trylock(&root_anon_vma->mutex)) {
                /*
-                * If we observe a !0 refcount, then holding the lock ensures
-                * the anon_vma will not go away, see __put_anon_vma().
+                * If the page is still mapped, then this anon_vma is still
+                * its anon_vma, and holding the mutex ensures that it will
+                * not go away, see anon_vma_free().
                 */
-               if (!atomic_read(&anon_vma->refcount)) {
-                       anon_vma_unlock(anon_vma);
+               if (!page_mapped(page)) {
+                       mutex_unlock(&root_anon_vma->mutex);
                        anon_vma = NULL;
                }
                goto out;