Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932474Ab2E3JD0 (ORCPT ); Wed, 30 May 2012 05:03:26 -0400 Received: from mail-vc0-f174.google.com ([209.85.220.174]:59799 "EHLO mail-vc0-f174.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932330Ab2E3JDT (ORCPT ); Wed, 30 May 2012 05:03:19 -0400 From: kosaki.motohiro@gmail.com To: linux-kernel@vger.kernel.org Cc: linux-mm@kvack.org, Andrew Morton , Dave Jones , Mel Gorman , Linus Torvalds , Christoph Lameter , stable@vger.kernel.org, hughd@google.com, KOSAKI Motohiro , Andrew Morton Subject: [PATCH 4/6] mempolicy: fix refcount leak in mpol_set_shared_policy() Date: Wed, 30 May 2012 05:02:07 -0400 Message-Id: <1338368529-21784-5-git-send-email-kosaki.motohiro@gmail.com> X-Mailer: git-send-email 1.7.1 In-Reply-To: <1338368529-21784-1-git-send-email-kosaki.motohiro@gmail.com> References: <1338368529-21784-1-git-send-email-kosaki.motohiro@gmail.com> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2196 Lines: 72 From: KOSAKI Motohiro When shared_policy_replace() failure, new->policy is not freed correctly. The real problem is, shared mempolicy codes directly call kmem_cache_free() in multiple place. It can be easily mistake. This patch creates proper wrapper function and uses it. The bug was introduced pre-git age (IOW, before 2.6.12-rc2). Cc: Dave Jones , Cc: Mel Gorman Cc: Linus Torvalds Cc: Christoph Lameter , Cc: Andrew Morton Cc: Signed-off-by: KOSAKI Motohiro --- mm/mempolicy.c | 15 +++++++++------ 1 files changed, 9 insertions(+), 6 deletions(-) diff --git a/mm/mempolicy.c b/mm/mempolicy.c index d97d2db..7fb7d51 100644 --- a/mm/mempolicy.c +++ b/mm/mempolicy.c @@ -2150,12 +2150,17 @@ mpol_shared_policy_lookup(struct shared_policy *sp, unsigned long idx) return pol; } +static void sp_free(struct sp_node *n) +{ + mpol_put(n->policy); + kmem_cache_free(sn_cache, n); +} + static void sp_delete(struct shared_policy *sp, struct sp_node *n) { pr_debug("deleting %lx-l%lx\n", n->start, n->end); rb_erase(&n->nd, &sp->root); - mpol_put(n->policy); - kmem_cache_free(sn_cache, n); + sp_free(n); } static void sp_node_init(struct sp_node *node, unsigned long start, @@ -2320,7 +2325,7 @@ int mpol_set_shared_policy(struct shared_policy *info, } err = shared_policy_replace(info, vma->vm_pgoff, vma->vm_pgoff+sz, new); if (err && new) - kmem_cache_free(sn_cache, new); + sp_free(new); return err; } @@ -2337,9 +2342,7 @@ void mpol_free_shared_policy(struct shared_policy *p) while (next) { n = rb_entry(next, struct sp_node, nd); next = rb_next(&n->nd); - rb_erase(&n->nd, &p->root); - mpol_put(n->policy); - kmem_cache_free(sn_cache, n); + sp_delete(p, n); } spin_unlock(&p->lock); } -- 1.7.1 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/