lkml.org 
[lkml]   [2012]   [Aug]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4/5] mempolicy: fix refcount leak in mpol_set_shared_policy()
    Date
    From: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>

    When shared_policy_replace() fails to allocate new->policy is not freed
    correctly by mpol_set_shared_policy(). The problem is that shared mempolicy
    code directly call kmem_cache_free() in multiple places where it is easy
    to make a mistake.

    This patch creates an sp_free wrapper function and uses it. The bug was
    introduced pre-git age (IOW, before 2.6.12-rc2).

    [mgorman@suse.de: Editted changelog]
    Signed-off-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
    Signed-off-by: Mel Gorman <mgorman@suse.de>
    ---
    mm/mempolicy.c | 15 +++++++++------
    1 files changed, 9 insertions(+), 6 deletions(-)

    diff --git a/mm/mempolicy.c b/mm/mempolicy.c
    index d297929..45f9825 100644
    --- a/mm/mempolicy.c
    +++ b/mm/mempolicy.c
    @@ -2157,12 +2157,17 @@ mpol_shared_policy_lookup(struct shared_policy *sp, unsigned long idx)
    return pol;
    }

    +static void sp_free(struct sp_node *n)
    +{
    + mpol_put(n->policy);
    + kmem_cache_free(sn_cache, n);
    +}
    +
    static void sp_delete(struct shared_policy *sp, struct sp_node *n)
    {
    pr_debug("deleting %lx-l%lx\n", n->start, n->end);
    rb_erase(&n->nd, &sp->root);
    - mpol_put(n->policy);
    - kmem_cache_free(sn_cache, n);
    + sp_free(n);
    }

    static struct sp_node *sp_alloc(unsigned long start, unsigned long end,
    @@ -2301,7 +2306,7 @@ int mpol_set_shared_policy(struct shared_policy *info,
    }
    err = shared_policy_replace(info, vma->vm_pgoff, vma->vm_pgoff+sz, new);
    if (err && new)
    - kmem_cache_free(sn_cache, new);
    + sp_free(new);
    return err;
    }

    @@ -2318,9 +2323,7 @@ void mpol_free_shared_policy(struct shared_policy *p)
    while (next) {
    n = rb_entry(next, struct sp_node, nd);
    next = rb_next(&n->nd);
    - rb_erase(&n->nd, &p->root);
    - mpol_put(n->policy);
    - kmem_cache_free(sn_cache, n);
    + sp_delete(p, n);
    }
    mutex_unlock(&p->mutex);
    }
    --
    1.7.7


    \
     
     \ /
      Last update: 2012-08-20 20:01    [W:3.127 / U:0.252 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site