mempolicy: fix refcount leak in mpol_set_shared_policy() (63f74ca2) · Commits · 戴 / test

When shared_policy_replace() fails to allocate new->policy is not freed correctly by mpol_set_shared_policy(). The problem is that shared mempolicy code directly call kmem_cache_free() in multiple places where it is easy to make a mistake. This patch creates an sp_free wrapper function and uses it. The bug was introduced pre-git age (IOW, before 2.6.12-rc2). [mgorman@suse.de: Editted changelog] Signed-off-by:

KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com> Signed-off-by:

Mel Gorman <mgorman@suse.de> Reviewed-by:

Christoph Lameter <cl@linux.com> Cc: Josh Boyer <jwboyer@gmail.com> Signed-off-by:

Andrew Morton <akpm@linux-foundation.org> Signed-off-by:

Linus Torvalds <torvalds@linux-foundation.org>

mm/mempolicy.c

+9 −6

Original line number	Diff line number	Diff line
		@@ -2157,12 +2157,17 @@ mpol_shared_policy_lookup(struct shared_policy *sp, unsigned long idx)
		return pol;
		}

		static void sp_free(struct sp_node *n)
		{
		mpol_put(n->policy);
		kmem_cache_free(sn_cache, n);
		}

		static void sp_delete(struct shared_policy sp, struct sp_node n)
		{
		pr_debug("deleting %lx-l%lx\n", n->start, n->end);
		rb_erase(&n->nd, &sp->root);
		mpol_put(n->policy);
		kmem_cache_free(sn_cache, n);
		sp_free(n);
		}

		static struct sp_node *sp_alloc(unsigned long start, unsigned long end,
		@@ -2301,7 +2306,7 @@ int mpol_set_shared_policy(struct shared_policy *info,
		}
		err = shared_policy_replace(info, vma->vm_pgoff, vma->vm_pgoff+sz, new);
		if (err && new)
		kmem_cache_free(sn_cache, new);
		sp_free(new);
		return err;
		}

		@@ -2318,9 +2323,7 @@ void mpol_free_shared_policy(struct shared_policy *p)
		while (next) {
		n = rb_entry(next, struct sp_node, nd);
		next = rb_next(&n->nd);
		rb_erase(&n->nd, &p->root);
		mpol_put(n->policy);
		kmem_cache_free(sn_cache, n);
		sp_delete(p, n);
		}
		mutex_unlock(&p->mutex);
		}

Admin message