mm: madvise: fix vma user-after-free

[mirror_ubuntu-focal-kernel.git] / mm / madvise.c

diff --git a/mm/madvise.c b/mm/madvise.c
index d8cfc3a0c1534cb4321048b67eebb175e5144782..26f7954865ed95f3974ab53aa8eb01963f2ab165 100644 (file)
--- a/mm/madvise.c
+++ b/mm/madvise.c
@@ -288,9 +288,9 @@ static long madvise_willneed(struct vm_area_struct *vma,
         */
        *prev = NULL;   /* tell sys_madvise we drop mmap_sem */
        get_file(file);
-       up_read(&current->mm->mmap_sem);
        offset = (loff_t)(start - vma->vm_start)
                        + ((loff_t)vma->vm_pgoff << PAGE_SHIFT);
+       up_read(&current->mm->mmap_sem);
        vfs_fadvise(file, offset, end - start, POSIX_FADV_WILLNEED);
        fput(file);
        down_read(&current->mm->mmap_sem);