The commit b5c8f0fd595d ("powerpc/mm: Rework mm_fault_error()") reviewed the way the error path is managed in __do_page_fault() but it was a bit too agressive when handling a case by returning without releasing the mmap_sem.
By the way, replacing current->mm->mmap_sem by mm->mmap_sem as mm is set to current->mm. Fixes: b5c8f0fd595d ("powerpc/mm: Rework mm_fault_error()") Cc: Benjamin Herrenschmidt <b...@kernel.crashing.org> Signed-off-by: Laurent Dufour <laurent....@free.fr> --- arch/powerpc/mm/fault.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c index 4797d08581ce..f799ccf37d27 100644 --- a/arch/powerpc/mm/fault.c +++ b/arch/powerpc/mm/fault.c @@ -521,10 +521,11 @@ static int __do_page_fault(struct pt_regs *regs, unsigned long address, * User mode? Just return to handle the fatal exception otherwise * return to bad_page_fault */ + up_read(&mm->mmap_sem); return is_user ? 0 : SIGBUS; } - up_read(¤t->mm->mmap_sem); + up_read(&mm->mmap_sem); if (unlikely(fault & VM_FAULT_ERROR)) return mm_fault_error(regs, address, fault); -- 2.7.4