mm/vma: Fix null pointer dereference in vms_abort_munmap_vmas()

Don't pass a NULL vma to the vma_iter_store(), instead set up the maple
state for the store and do it manually.  vma_iter_clear() cannot be used
as it needs preallocations.

Signed-off-by: Liam R. Howlett <Liam.Howlett@Oracle.com>
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>

diff --git a/mm/vma.h b/mm/vma.h
index f710812482a19306e1b0a2568e688f84bddb13e0..5f525d7233902353e9c0b7985f5022c17e75c277 100644 (file)
--- a/mm/vma.h
+++ b/mm/vma.h
@@ -173,6 +173,7 @@ static inline void reattach_vmas(struct ma_state *mas_detach)
 static inline void vms_abort_munmap_vmas(struct vma_munmap_struct *vms,
                struct ma_state *mas_detach)
 {
+       struct ma_state *mas = &vms->vmi->mas;
        if (!vms->nr_pages)
                return;
 
@@ -184,13 +185,14 @@ static inline void vms_abort_munmap_vmas(struct vma_munmap_struct *vms,
         * not symmetrical and state data has been lost.  Resort to the old
         * failure method of leaving a gap where the MAP_FIXED mapping failed.
         */
-       if (unlikely(vma_iter_store_gfp(vms->vmi, NULL, GFP_KERNEL))) {
+       mas_set_range(mas, vms->start, vms->end);
+       if (unlikely(mas_store_gfp(mas, NULL, GFP_KERNEL))) {
                pr_warn_once("%s: (%d) Unable to abort munmap() operation\n",
                             current->comm, current->pid);
                /* Leaving vmas detached and in-tree may hamper recovery */
                reattach_vmas(mas_detach);
        } else {
-               /* Clean up the insertion of unfortunate the gap */
+               /* Clean up the insertion of the unfortunate gap */
                vms_complete_munmap_vmas(vms, mas_detach);
        }
 }