bdi: Fix use after free bug in debugfs_remove()

[mirror_ubuntu-bionic-kernel.git] / mm / nommu.c

diff --git a/mm/nommu.c b/mm/nommu.c
index 17c00d93de2e4973278845e98554ce2040445f65..4bcdf9448dd0bb44067027804932ebd6e6c95d02 100644 (file)
--- a/mm/nommu.c
+++ b/mm/nommu.c
@@ -641,7 +641,7 @@ static void __put_nommu_region(struct vm_region *region)
                up_write(&nommu_region_sem);
 
                if (region->vm_file)
-                       fput(region->vm_file);
+                       vmr_fput(region);
 
                /* IO memory and memory shared directly out of the pagecache
                 * from ramfs/tmpfs mustn't be released here */
@@ -799,7 +799,7 @@ static void delete_vma(struct mm_struct *mm, struct vm_area_struct *vma)
        if (vma->vm_ops && vma->vm_ops->close)
                vma->vm_ops->close(vma);
        if (vma->vm_file)
-               fput(vma->vm_file);
+               vma_fput(vma);
        put_nommu_region(vma->vm_region);
        kmem_cache_free(vm_area_cachep, vma);
 }
@@ -1321,7 +1321,7 @@ unsigned long do_mmap(struct file *file,
                                        goto error_just_free;
                                }
                        }
-                       fput(region->vm_file);
+                       vmr_fput(region);
                        kmem_cache_free(vm_region_jar, region);
                        region = pregion;
                        result = start;
@@ -1396,10 +1396,10 @@ error_just_free:
        up_write(&nommu_region_sem);
 error:
        if (region->vm_file)
-               fput(region->vm_file);
+               vmr_fput(region);
        kmem_cache_free(vm_region_jar, region);
        if (vma->vm_file)
-               fput(vma->vm_file);
+               vma_fput(vma);
        kmem_cache_free(vm_area_cachep, vma);
        return ret;