diff options
| author | Nicholas Piggin <[email protected]> | 2023-06-07 20:10:24 +1000 |
|---|---|---|
| committer | Michael Ellerman <[email protected]> | 2023-06-15 14:04:19 +1000 |
| commit | b4bda59b47879cce38a6ec5a01cd3cac702b5331 (patch) | |
| tree | 1eabf59f11b9e2051ea04d09304ec7dc98eef186 | |
| parent | 27be2456332dcd69907f086cda327ad923b222cf (diff) | |
powerpc/64s: Fix VAS mm use after free
The refcount on mm is dropped before the coprocessor is detached.
Reported-by: Sachin Sant <[email protected]>
Fixes: 7bc6f71bdff5f ("powerpc/vas: Define and use common vas_window struct")
Fixes: b22f2d88e435c ("powerpc/pseries/vas: Integrate API with open/close windows")
Signed-off-by: Nicholas Piggin <[email protected]>
Tested-by: Sachin Sant <[email protected]>
Signed-off-by: Michael Ellerman <[email protected]>
Link: https://msgid.link/[email protected]
| -rw-r--r-- | arch/powerpc/platforms/powernv/vas-window.c | 2 | ||||
| -rw-r--r-- | arch/powerpc/platforms/pseries/vas.c | 2 |
2 files changed, 2 insertions, 2 deletions
diff --git a/arch/powerpc/platforms/powernv/vas-window.c b/arch/powerpc/platforms/powernv/vas-window.c index 0072682531d8..b664838008c1 100644 --- a/arch/powerpc/platforms/powernv/vas-window.c +++ b/arch/powerpc/platforms/powernv/vas-window.c @@ -1310,8 +1310,8 @@ int vas_win_close(struct vas_window *vwin) /* if send window, drop reference to matching receive window */ if (window->tx_win) { if (window->user_win) { - put_vas_user_win_ref(&vwin->task_ref); mm_context_remove_vas_window(vwin->task_ref.mm); + put_vas_user_win_ref(&vwin->task_ref); } put_rx_win(window->rxwin); } diff --git a/arch/powerpc/platforms/pseries/vas.c b/arch/powerpc/platforms/pseries/vas.c index 513180467562..9a44a98ba342 100644 --- a/arch/powerpc/platforms/pseries/vas.c +++ b/arch/powerpc/platforms/pseries/vas.c @@ -507,8 +507,8 @@ static int vas_deallocate_window(struct vas_window *vwin) vascaps[win->win_type].nr_open_windows--; mutex_unlock(&vas_pseries_mutex); - put_vas_user_win_ref(&vwin->task_ref); mm_context_remove_vas_window(vwin->task_ref.mm); + put_vas_user_win_ref(&vwin->task_ref); kfree(win); return 0; |