Re: Oops with?2.5.40

[Hugh Dickins]

On Thu, 10 Oct 2002, William Lee Irwin III wrote:
> On Thu, Oct 10, 2002 at 10:46:02PM +0300, Sampsa Ranta wrote:
> > Call Trace:
> >  [<c013897f>]change_protection+0x1af/0x200
> >  [<c0138af3>]mprotect_attempt_merge+0x123/0x1e0
> >  [<c0138d3d>]mprotect_fixup+0x18d/0x1b0
> >  [<c0138ec4>]sys_mprotect+0x164/0x2f3
> >  [<c014d541>]sys_write+0x31/0x40
> >  [<c010786f>]syscall_call+0x7/0xb
> > Code: 23 53 7c 39 58 60 75 38 8b 40 5c 85 c0 74 08 0f 20 d8 0f 22
> >  <6>note: java[11999] exited with preempt_count 2
> 
> Fixed by Hugh in:
> 
> ChangeSet@1.750, 2002-10-10 11:03:56-07:00, [e-mail]
>   [PATCH] mremap use-after-free bugfix

Actually no: similar, but this one was fixed by Hugh in 2.5.41:

--- 2.5.40/mm/mprotect.c	Fri Sep 27 23:56:45 2002
+++ 2.5.41/mm/mprotect.c	Mon Oct  7 20:37:50 2002
@@ -186,8 +186,10 @@
 		/*
 		 * Try to merge with the previous vma.
 		 */
-		if (mprotect_attempt_merge(vma, *pprev, end, newflags))
+		if (mprotect_attempt_merge(vma, *pprev, end, newflags)) {
+			vma = *pprev;
 			goto success;
+		}
 	} else {
 		error = split_vma(mm, vma, start, 1);
 		if (error)