[PATCH] rmap: anon_vma_prepare() can leak anon_vma_chain
in [Kernel]
|
Prev: [Bug #15505] No more b43 wireless interface since 2.6.34-rc1
Next: RCU: don't turn off lockdep when find suspicious rcu_dereference_check() usage
From: Oleg Nesterov on 20 Apr 2010 15:30 If find_mergeable_anon_vma() succeeds but another thread installs ->anon_vma before we take ptl, then allocated == NULL but avc should be freed. Change the code to check avc != NULL to detect this case. Also, a couple of whitespace changes to make the critical section more visible. Signed-off-by: Oleg Nesterov <oleg(a)redhat.com> --- mm/rmap.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) --- 34-rc1/mm/rmap.c~AVP_AVC_LEAK 2010-03-11 13:11:50.000000000 +0100 +++ 34-rc1/mm/rmap.c 2010-04-20 21:05:24.000000000 +0200 @@ -133,8 +133,8 @@ int anon_vma_prepare(struct vm_area_stru goto out_enomem_free_avc; allocated = anon_vma; } - spin_lock(&anon_vma->lock); + spin_lock(&anon_vma->lock); /* page_table_lock to protect against threads */ spin_lock(&mm->page_table_lock); if (likely(!vma->anon_vma)) { @@ -144,14 +144,15 @@ int anon_vma_prepare(struct vm_area_stru list_add(&avc->same_vma, &vma->anon_vma_chain); list_add(&avc->same_anon_vma, &anon_vma->head); allocated = NULL; + avc = NULL; } spin_unlock(&mm->page_table_lock); - spin_unlock(&anon_vma->lock); - if (unlikely(allocated)) { + + if (unlikely(allocated)) anon_vma_free(allocated); + if (unlikely(avc)) anon_vma_chain_free(avc); - } } return 0; -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo(a)vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/ |