Commit 31f2b0eb authored Apr 23, 2010 by Oleg Nesterov Committed by Linus Torvalds Apr 24, 2010

rmap: anon_vma_prepare() can leak anon_vma_chain



If find_mergeable_anon_vma() succeeds but another thread installs
->anon_vma before we take ptl, then allocated == NULL but avc should be
freed.  Change the code to check avc != NULL to detect this case.

Also, a couple of whitespace changes to make the critical section more
visible.

Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Reviewed-by: Rik van Riel <riel@redhat.com>
Cc: Hugh Dickins <hugh.dickins@tiscali.co.uk>
Cc: Pete Zaitcev <zaitcev@redhat.com>
Cc: Borislav Petkov <bp@alien8.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

parent 93b4a44f

mm/rmap.c

+5 −4

Original line number	Diff line number	Diff line
		@@ -133,8 +133,8 @@ int anon_vma_prepare(struct vm_area_struct *vma)
		goto out_enomem_free_avc;
		allocated = anon_vma;
		}
		spin_lock(&anon_vma->lock);

		spin_lock(&anon_vma->lock);
		/* page_table_lock to protect against threads */
		spin_lock(&mm->page_table_lock);
		if (likely(!vma->anon_vma)) {
		@@ -144,15 +144,16 @@ int anon_vma_prepare(struct vm_area_struct *vma)
		list_add(&avc->same_vma, &vma->anon_vma_chain);
		list_add(&avc->same_anon_vma, &anon_vma->head);
		allocated = NULL;
		avc = NULL;
		}
		spin_unlock(&mm->page_table_lock);

		spin_unlock(&anon_vma->lock);
		if (unlikely(allocated)) {

		if (unlikely(allocated))
		anon_vma_free(allocated);
		if (unlikely(avc))
		anon_vma_chain_free(avc);
		}
		}
		return 0;

		out_enomem_free_avc:

Admin message