mm/mmap: write-lock adjacent VMAs if they can grow into unmapped area

While unmapping VMAs, adjacent VMAs might be able to grow into the area
being unmapped. In such cases write-lock adjacent VMAs to prevent this
growth.

Signed-off-by: Suren Baghdasaryan <surenb@google.com>

diff --git a/mm/mmap.c b/mm/mmap.c
index e320b6ae2cf69bf528d62ded2066e9860e334806..7ca2632556e05d76401ef8b0fe1e3ca0da73f44b 100644 (file)
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -2462,11 +2462,13 @@ do_mas_align_munmap(struct ma_state *mas, struct vm_area_struct *vma,
         * down_read(mmap_lock) and collide with the VMA we are about to unmap.
         */
        if (downgrade) {
-               if (next && (next->vm_flags & VM_GROWSDOWN))
+               if (next && (next->vm_flags & VM_GROWSDOWN)) {
+                       vma_write_lock(next);
                        downgrade = false;
-               else if (prev && (prev->vm_flags & VM_GROWSUP))
+               } else if (prev && (prev->vm_flags & VM_GROWSUP)) {
+                       vma_write_lock(prev);
                        downgrade = false;
-               else
+               } else
                        mmap_write_downgrade(mm);
        }