-
Arve Hjønnevåg authored
binder_update_page_range could read freed memory if the vma of the selected process was freed right before the check that the vma belongs to the mm struct it just locked. If the vm_mm pointer in that freed vma struct had also been rewritten with a value that matched the locked mm struct, then the code would proceed and possibly modify the freed vma. Signed-off-by:
Arve Hjønnevåg <arve@android.com> Signed-off-by:
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2a90957f