mm: madvise: fix vma user-after-free

[mirror_ubuntu-focal-kernel.git] / mm / page_counter.c

diff --git a/mm/page_counter.c b/mm/page_counter.c
index de31470655f66c3492b1858bd308eedd95917afd..147ff99187b8197142746ef13cc28acf77dd05cf 100644 (file)
--- a/mm/page_counter.c
+++ b/mm/page_counter.c
@@ -77,7 +77,7 @@ void page_counter_charge(struct page_counter *counter, unsigned long nr_pages)
                long new;
 
                new = atomic_long_add_return(nr_pages, &c->usage);
-               propagate_protected_usage(counter, new);
+               propagate_protected_usage(c, new);
                /*
                 * This is indeed racy, but we can live with some
                 * inaccuracy in the watermark.
@@ -121,7 +121,7 @@ bool page_counter_try_charge(struct page_counter *counter,
                new = atomic_long_add_return(nr_pages, &c->usage);
                if (new > c->max) {
                        atomic_long_sub(nr_pages, &c->usage);
-                       propagate_protected_usage(counter, new);
+                       propagate_protected_usage(c, new);
                        /*
                         * This is racy, but we can live with some
                         * inaccuracy in the failcnt.
@@ -130,7 +130,7 @@ bool page_counter_try_charge(struct page_counter *counter,
                        *fail = c;
                        goto failed;
                }
-               propagate_protected_usage(counter, new);
+               propagate_protected_usage(c, new);
                /*
                 * Just like with failcnt, we can live with some
                 * inaccuracy in the watermark.