Messages in this thread Patch in this message | | | Date | Tue, 20 Apr 2010 21:24:21 +0200 | From | Oleg Nesterov <> | Subject | [PATCH] rmap: anon_vma_prepare() can leak anon_vma_chain |
| |
If find_mergeable_anon_vma() succeeds but another thread installs ->anon_vma before we take ptl, then allocated == NULL but avc should be freed. Change the code to check avc != NULL to detect this case.
Also, a couple of whitespace changes to make the critical section more visible.
Signed-off-by: Oleg Nesterov <oleg@redhat.com> ---
mm/rmap.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
--- 34-rc1/mm/rmap.c~AVP_AVC_LEAK 2010-03-11 13:11:50.000000000 +0100 +++ 34-rc1/mm/rmap.c 2010-04-20 21:05:24.000000000 +0200 @@ -133,8 +133,8 @@ int anon_vma_prepare(struct vm_area_stru goto out_enomem_free_avc; allocated = anon_vma; } - spin_lock(&anon_vma->lock); + spin_lock(&anon_vma->lock); /* page_table_lock to protect against threads */ spin_lock(&mm->page_table_lock); if (likely(!vma->anon_vma)) { @@ -144,14 +144,15 @@ int anon_vma_prepare(struct vm_area_stru list_add(&avc->same_vma, &vma->anon_vma_chain); list_add(&avc->same_anon_vma, &anon_vma->head); allocated = NULL; + avc = NULL; } spin_unlock(&mm->page_table_lock); - spin_unlock(&anon_vma->lock); - if (unlikely(allocated)) { + + if (unlikely(allocated)) anon_vma_free(allocated); + if (unlikely(avc)) anon_vma_chain_free(avc); - } } return 0;
| |