Commit 63f74ca2 authored by KOSAKI Motohiro's avatar KOSAKI Motohiro Committed by Linus Torvalds

mempolicy: fix refcount leak in mpol_set_shared_policy()

When shared_policy_replace() fails to allocate new->policy is not freed
correctly by mpol_set_shared_policy().  The problem is that shared
mempolicy code directly call kmem_cache_free() in multiple places where
it is easy to make a mistake.

This patch creates an sp_free wrapper function and uses it. The bug was
introduced pre-git age (IOW, before 2.6.12-rc2).

[mgorman@suse.de: Editted changelog]
Signed-off-by: default avatarKOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Signed-off-by: default avatarMel Gorman <mgorman@suse.de>
Reviewed-by: default avatarChristoph Lameter <cl@linux.com>
Cc: Josh Boyer <jwboyer@gmail.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent b22d127a
...@@ -2157,12 +2157,17 @@ mpol_shared_policy_lookup(struct shared_policy *sp, unsigned long idx) ...@@ -2157,12 +2157,17 @@ mpol_shared_policy_lookup(struct shared_policy *sp, unsigned long idx)
return pol; return pol;
} }
static void sp_free(struct sp_node *n)
{
mpol_put(n->policy);
kmem_cache_free(sn_cache, n);
}
static void sp_delete(struct shared_policy *sp, struct sp_node *n) static void sp_delete(struct shared_policy *sp, struct sp_node *n)
{ {
pr_debug("deleting %lx-l%lx\n", n->start, n->end); pr_debug("deleting %lx-l%lx\n", n->start, n->end);
rb_erase(&n->nd, &sp->root); rb_erase(&n->nd, &sp->root);
mpol_put(n->policy); sp_free(n);
kmem_cache_free(sn_cache, n);
} }
static struct sp_node *sp_alloc(unsigned long start, unsigned long end, static struct sp_node *sp_alloc(unsigned long start, unsigned long end,
...@@ -2301,7 +2306,7 @@ int mpol_set_shared_policy(struct shared_policy *info, ...@@ -2301,7 +2306,7 @@ int mpol_set_shared_policy(struct shared_policy *info,
} }
err = shared_policy_replace(info, vma->vm_pgoff, vma->vm_pgoff+sz, new); err = shared_policy_replace(info, vma->vm_pgoff, vma->vm_pgoff+sz, new);
if (err && new) if (err && new)
kmem_cache_free(sn_cache, new); sp_free(new);
return err; return err;
} }
...@@ -2318,9 +2323,7 @@ void mpol_free_shared_policy(struct shared_policy *p) ...@@ -2318,9 +2323,7 @@ void mpol_free_shared_policy(struct shared_policy *p)
while (next) { while (next) {
n = rb_entry(next, struct sp_node, nd); n = rb_entry(next, struct sp_node, nd);
next = rb_next(&n->nd); next = rb_next(&n->nd);
rb_erase(&n->nd, &p->root); sp_delete(p, n);
mpol_put(n->policy);
kmem_cache_free(sn_cache, n);
} }
mutex_unlock(&p->mutex); mutex_unlock(&p->mutex);
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment