Re: [PATCH v2 1/1] mm: fix use-after-free when anon vma name is used after vma is freed

[Matthew Wilcox]

On Wed, Feb 09, 2022 at 08:32:15PM -0800, Suren Baghdasaryan wrote:
> +void vma_anon_name_put(struct anon_vma_name *anon_name)
> +{
> +	kref_put(&anon_name->kref, vma_anon_name_free);
> +}

To agree with Michal, make this:

	if (anon_name)
		kref_put(&anon_name->kref, vma_anon_name_free);

>  
> -	error = madvise_update_vma(vma, prev, start, end, new_flags,
> -				   vma_anon_name(vma));
> +	anon_name = vma_anon_name_get(vma);
> +	if (anon_name) {
> +		error = madvise_update_vma(vma, prev, start, end, new_flags,
> +					   anon_name->name);
> +		vma_anon_name_put(anon_name);
> +	} else {
> +		error = madvise_update_vma(vma, prev, start, end, new_flags,
> +					   NULL);
> +	}

And then this becomes:

	anon_name = vma_anon_name_get(vma);
	error = madvise_update_vma(vma, prev, start, end, new_flags, anon_name);
	vma_anon_name_put(anon_name);