From 9c96b76d89c25b2fd59c516081af6893567ec0f8 Mon Sep 17 00:00:00 2001
From: Andrew Morton <akpm@digeo.com>
Date: Wed, 2 Oct 2002 22:56:57 -0700
Subject: [PATCH] [PATCH] mprotect bugfix

Patch from Hugh Dickins

Our earlier fix for mprotect_fixup was broken - passing an
already-freed VMA to change_protection().
---
 mm/mprotect.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/mm/mprotect.c b/mm/mprotect.c
index be0096238437..d14c2354b7b8 100644
--- a/mm/mprotect.c
+++ b/mm/mprotect.c
@@ -186,8 +186,10 @@ mprotect_fixup(struct vm_area_struct *vma, struct vm_area_struct **pprev,
 		/*
 		 * Try to merge with the previous vma.
 		 */
-		if (mprotect_attempt_merge(vma, *pprev, end, newflags))
+		if (mprotect_attempt_merge(vma, *pprev, end, newflags)) {
+			vma = *pprev;
 			goto success;
+		}
 	} else {
 		error = split_vma(mm, vma, start, 1);
 		if (error)
-- 
2.30.9