lkml.org 
[lkml]   [2023]   [Jan]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
SubjectRe: [PATCH 1/1] mm: fix vma->anon_name memory leak for anonymous shmem VMAs
From
On 28.12.22 20:42, Suren Baghdasaryan wrote:
> free_anon_vma_name() is missing a check for anonymous shmem VMA which
> leads to a memory leak due to refcount not being dropped. Fix this by
> adding the missing check.
>
> Fixes: d09e8ca6cb93 ("mm: anonymous shared memory naming")
> Reported-by: syzbot+91edf9178386a07d06a7@syzkaller.appspotmail.com
> Signed-off-by: Suren Baghdasaryan <surenb@google.com>
> ---
> include/linux/mm_inline.h | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/include/linux/mm_inline.h b/include/linux/mm_inline.h
> index e8ed225d8f7c..d650ca2c5d29 100644
> --- a/include/linux/mm_inline.h
> +++ b/include/linux/mm_inline.h
> @@ -413,7 +413,7 @@ static inline void free_anon_vma_name(struct vm_area_struct *vma)
> * Not using anon_vma_name because it generates a warning if mmap_lock
> * is not held, which might be the case here.
> */
> - if (!vma->vm_file)
> + if (!vma->vm_file || vma_is_anon_shmem(vma))
> anon_vma_name_put(vma->anon_name);

Wouldn't it be me more consistent to check for "vma->anon_name"?

That's what dup_anon_vma_name() checks. And it's safe now because
anon_name is no longer overloaded in vm_area_struct.

--
Thanks,

David / dhildenb

\
 
 \ /
  Last update: 2023-03-26 23:24    [W:0.087 / U:0.712 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site