vma_expand() was only locking either file or anon based locks but could unlock both. This caused a locking error in trinity fuzzer. Allow both locks to be taken and released. Fixes: a5985220056d (mm/mmap: use advanced maple tree API for mmap_region()) Signed-off-by: Liam R. Howlett <Liam.Howlett@xxxxxxxxxx> --- mm/mmap.c | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/mm/mmap.c b/mm/mmap.c index 5599c36283dd..315c3ca118cb 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -592,6 +592,11 @@ inline int vma_expand(struct ma_state *mas, struct vm_area_struct *vma, vma_adjust_trans_huge(vma, start, end, 0); + if (anon_vma) { + anon_vma_lock_write(anon_vma); + anon_vma_interval_tree_pre_update_vma(vma); + } + if (file) { mapping = file->f_mapping; root = &mapping->i_mmap; @@ -599,9 +604,6 @@ inline int vma_expand(struct ma_state *mas, struct vm_area_struct *vma, i_mmap_lock_write(mapping); flush_dcache_mmap_lock(mapping); vma_interval_tree_remove(vma, root); - } else if (anon_vma) { - anon_vma_lock_write(anon_vma); - anon_vma_interval_tree_pre_update_vma(vma); } vma->vm_start = start; @@ -620,15 +622,16 @@ inline int vma_expand(struct ma_state *mas, struct vm_area_struct *vma, __remove_shared_vm_struct(next, file, mapping); } + if (file) { + i_mmap_unlock_write(mapping); + uprobe_mmap(vma); + } + if (anon_vma) { anon_vma_interval_tree_post_update_vma(vma); anon_vma_unlock_write(anon_vma); } - if (file) { - i_mmap_unlock_write(mapping); - uprobe_mmap(vma); - } if (remove_next) { if (file) { -- 2.35.1