ANDROID: mm: avoid using vmacache in lockless vma search
When searching vma under RCU protection vmcache should be avoided because
a race with munmap() might result in finding a vma and placing it into
vmcache after munmap() removed that vma and called vmcache_invalidate.
Once that vma is freed, vmcache will be left with an invalid vma pointer.
Bug: 257443051
Change-Id: I62438305fcf5139974f4f7d3bae5b22c74084a59
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
diff --git a/mm/memory.c b/mm/memory.c
index 6519783..3172677 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -216,7 +216,7 @@ struct vm_area_struct *get_vma(struct mm_struct *mm, unsigned long addr)
struct vm_area_struct *vma;
rcu_read_lock();
- vma = __find_vma(mm, addr);
+ vma = find_vma_from_tree(mm, addr);
if (vma) {
if (vma->vm_start > addr ||
!atomic_inc_unless_negative(&vma->file_ref_count))