diff options
| author | KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com> | 2012-10-08 16:29:19 -0700 |
|---|---|---|
| committer | Ben Hutchings <ben@decadent.org.uk> | 2012-10-17 03:49:59 +0100 |
| commit | 54e670386ee302cd17d17ac398d1e718307633f2 (patch) | |
| tree | ba5b17185734c4381cc0838436d1b0f53fceb3f7 /mm/mempolicy.c | |
| parent | 507c18443d05543b9903d2341f8473dd6191f8ef (diff) | |
| download | kernel_samsung_smdk4412-54e670386ee302cd17d17ac398d1e718307633f2.zip kernel_samsung_smdk4412-54e670386ee302cd17d17ac398d1e718307633f2.tar.gz kernel_samsung_smdk4412-54e670386ee302cd17d17ac398d1e718307633f2.tar.bz2 | |
mempolicy: fix refcount leak in mpol_set_shared_policy()
commit 63f74ca21f1fad36d075e063f06dcc6d39fe86b2 upstream.
When shared_policy_replace() fails to allocate new->policy is not freed
correctly by mpol_set_shared_policy(). The problem is that shared
mempolicy code directly call kmem_cache_free() in multiple places where
it is easy to make a mistake.
This patch creates an sp_free wrapper function and uses it. The bug was
introduced pre-git age (IOW, before 2.6.12-rc2).
[mgorman@suse.de: Editted changelog]
Signed-off-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Signed-off-by: Mel Gorman <mgorman@suse.de>
Reviewed-by: Christoph Lameter <cl@linux.com>
Cc: Josh Boyer <jwboyer@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Mel Gorman <mgorman@suse.de>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Diffstat (limited to 'mm/mempolicy.c')
| -rw-r--r-- | mm/mempolicy.c | 15 |
1 files changed, 9 insertions, 6 deletions
diff --git a/mm/mempolicy.c b/mm/mempolicy.c index 2ac1b38..0c13a1b 100644 --- a/mm/mempolicy.c +++ b/mm/mempolicy.c @@ -2121,12 +2121,17 @@ mpol_shared_policy_lookup(struct shared_policy *sp, unsigned long idx) return pol; } +static void sp_free(struct sp_node *n) +{ + mpol_put(n->policy); + kmem_cache_free(sn_cache, n); +} + static void sp_delete(struct shared_policy *sp, struct sp_node *n) { pr_debug("deleting %lx-l%lx\n", n->start, n->end); rb_erase(&n->nd, &sp->root); - mpol_put(n->policy); - kmem_cache_free(sn_cache, n); + sp_free(n); } static struct sp_node *sp_alloc(unsigned long start, unsigned long end, @@ -2265,7 +2270,7 @@ int mpol_set_shared_policy(struct shared_policy *info, } err = shared_policy_replace(info, vma->vm_pgoff, vma->vm_pgoff+sz, new); if (err && new) - kmem_cache_free(sn_cache, new); + sp_free(new); return err; } @@ -2282,9 +2287,7 @@ void mpol_free_shared_policy(struct shared_policy *p) while (next) { n = rb_entry(next, struct sp_node, nd); next = rb_next(&n->nd); - rb_erase(&n->nd, &p->root); - mpol_put(n->policy); - kmem_cache_free(sn_cache, n); + sp_delete(p, n); } mutex_unlock(&p->mutex); } |