mm: rmap: fix use-after-free in __put_anon_vma
mm: rmap: fix use-after-free in __put_anon_vma

While working address sanitizer for kernel I've discovered
use-after-free bug in __put_anon_vma.

For the last anon_vma, anon_vma->root freed before child anon_vma.
Later in anon_vma_free(anon_vma) we are referencing to already freed
anon_vma->root to check rwsem.

This fixes it by freeing the child anon_vma before freeing
anon_vma->root.

Signed-off-by: Andrey Ryabinin <d7a2c23eccda99639e3fab64d868a1b1895748fa@samsung.com>
Acked-by: Peter Zijlstra <3fddac958924aef220f202ca567388ddab3f14a8@infradead.org>
Cc: <4fbacc2fa0ffdbb11bf1ad6925b886ebd08dd15f@vger.kernel.org> # v3.0+
Signed-off-by: Linus Torvalds <69652caca27c8b940640ad396ab71f93cacec34f@linux-foundation.org>

KristFoundation/Programs,KristFoundation/Programs,KristFoundation/Programs,KristFoundation/Programs,KristFoundation/Programs,KristFoundation/Programs