mm/mmap: Fix use-after-free when expanding the VMA

mm/mmap: Fix use-after-free when expanding the VMA

Expanding the VMA can cause new maple tree nodes to be used if a gap
disappears, or the VMA expands beyond the node boundary into the
preceding node (GROWSUP only).  Since the expansion only takes the read
lock and other readers are not taking the rcu read lock, other walkers
may still have a pointer to the freed node.

Fix the use-after-free by dropping the read lock and obtaining the write
lock in these cases.  In the case of GROWSUP, ensure the write lock is
always taken.

Fixes: d4af56c5c7c6 ("mm: start tracking VMAs with maple tree")
Cc: stable@vger.kernel.org
Reported-and-tested-by: syzbot+f3728183b2f78d0d40f6@syzkaller.appspotmail.com
Reported-by: Ruihan Li <lrh2000@pku.edu.cn>
Co-Developed-by: Matthew Wilcox (Oracle) <willy@infradead.org>
Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
Signed-off-by: Liam R. Howlett <Liam.Howlett@oracle.com>