ax25: add refcount in ax25_dev to avoid UAF bugs

[mirror_ubuntu-jammy-kernel.git] / mm / mempolicy.c

diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index d12e0608fced235dc9137d0628437046299c7cfc..e75872035c7685631b8b025e32585225d4374a8f 100644 (file)
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -783,7 +783,6 @@ static int vma_replace_policy(struct vm_area_struct *vma,
 static int mbind_range(struct mm_struct *mm, unsigned long start,
                       unsigned long end, struct mempolicy *new_pol)
 {
-       struct vm_area_struct *next;
        struct vm_area_struct *prev;
        struct vm_area_struct *vma;
        int err = 0;
@@ -798,8 +797,7 @@ static int mbind_range(struct mm_struct *mm, unsigned long start,
        if (start > vma->vm_start)
                prev = vma;
 
-       for (; vma && vma->vm_start < end; prev = vma, vma = next) {
-               next = vma->vm_next;
+       for (; vma && vma->vm_start < end; prev = vma, vma = vma->vm_next) {
                vmstart = max(start, vma->vm_start);
                vmend   = min(end, vma->vm_end);
 
@@ -813,10 +811,6 @@ static int mbind_range(struct mm_struct *mm, unsigned long start,
                                 new_pol, vma->vm_userfaultfd_ctx);
                if (prev) {
                        vma = prev;
-                       next = vma->vm_next;
-                       if (mpol_equal(vma_policy(vma), new_pol))
-                               continue;
-                       /* vma_merge() joined vma && vma->next, case 8 */
                        goto replace;
                }
                if (vma->vm_start != vmstart) {
@@ -2140,8 +2134,7 @@ struct page *alloc_pages_vma(gfp_t gfp, int order, struct vm_area_struct *vma,
                         * memory with both reclaim and compact as well.
                         */
                        if (!page && (gfp & __GFP_DIRECT_RECLAIM))
-                               page = __alloc_pages_node(hpage_node,
-                                                               gfp, order);
+                               page = __alloc_pages(gfp, order, hpage_node, nmask);
 
                        goto out;
                }
@@ -2568,6 +2561,7 @@ alloc_new:
        mpol_new = kmem_cache_alloc(policy_cache, GFP_KERNEL);
        if (!mpol_new)
                goto err_out;
+       atomic_set(&mpol_new->refcnt, 1);
        goto restart;
 }