summaryrefslogtreecommitdiff
path: root/mm
diff options
context:
space:
mode:
authorKOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>2012-10-08 16:29:19 -0700
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2012-10-13 05:38:57 +0900
commit04ea8a8388992ad12bc1b32cc16f4220300ea167 (patch)
tree5f043e7c716903e12b7d43a7a0caa4d7b9eb5b75 /mm
parent04a30bd9dccbeee2cc6b035e42a37e9be0fa8c6c (diff)
downloadlinux-3.10-04ea8a8388992ad12bc1b32cc16f4220300ea167.tar.gz
linux-3.10-04ea8a8388992ad12bc1b32cc16f4220300ea167.tar.bz2
linux-3.10-04ea8a8388992ad12bc1b32cc16f4220300ea167.zip
mempolicy: fix refcount leak in mpol_set_shared_policy()
commit 63f74ca21f1fad36d075e063f06dcc6d39fe86b2 upstream. When shared_policy_replace() fails to allocate new->policy is not freed correctly by mpol_set_shared_policy(). The problem is that shared mempolicy code directly call kmem_cache_free() in multiple places where it is easy to make a mistake. This patch creates an sp_free wrapper function and uses it. The bug was introduced pre-git age (IOW, before 2.6.12-rc2). [mgorman@suse.de: Editted changelog] Signed-off-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com> Signed-off-by: Mel Gorman <mgorman@suse.de> Reviewed-by: Christoph Lameter <cl@linux.com> Cc: Josh Boyer <jwboyer@gmail.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'mm')
-rw-r--r--mm/mempolicy.c15
1 files changed, 9 insertions, 6 deletions
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index 30850253c06..06531fc365e 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -2131,12 +2131,17 @@ mpol_shared_policy_lookup(struct shared_policy *sp, unsigned long idx)
return pol;
}
+static void sp_free(struct sp_node *n)
+{
+ mpol_put(n->policy);
+ kmem_cache_free(sn_cache, n);
+}
+
static void sp_delete(struct shared_policy *sp, struct sp_node *n)
{
pr_debug("deleting %lx-l%lx\n", n->start, n->end);
rb_erase(&n->nd, &sp->root);
- mpol_put(n->policy);
- kmem_cache_free(sn_cache, n);
+ sp_free(n);
}
static struct sp_node *sp_alloc(unsigned long start, unsigned long end,
@@ -2275,7 +2280,7 @@ int mpol_set_shared_policy(struct shared_policy *info,
}
err = shared_policy_replace(info, vma->vm_pgoff, vma->vm_pgoff+sz, new);
if (err && new)
- kmem_cache_free(sn_cache, new);
+ sp_free(new);
return err;
}
@@ -2292,9 +2297,7 @@ void mpol_free_shared_policy(struct shared_policy *p)
while (next) {
n = rb_entry(next, struct sp_node, nd);
next = rb_next(&n->nd);
- rb_erase(&n->nd, &p->root);
- mpol_put(n->policy);
- kmem_cache_free(sn_cache, n);
+ sp_delete(p, n);
}
mutex_unlock(&p->mutex);
}