Commit a190887b authored Sep 05, 2009 by David Howells Committed by Linus Torvalds Sep 05, 2009

nommu: fix error handling in do_mmap_pgoff()



Fix the error handling in do_mmap_pgoff().  If do_mmap_shared_file() or
do_mmap_private() fail, we jump to the error_put_region label at which
point we cann __put_nommu_region() on the region - but we haven't yet
added the region to the tree, and so __put_nommu_region() may BUG
because the region tree is empty or it may corrupt the region tree.

To get around this, we can afford to add the region to the region tree
before calling do_mmap_shared_file() or do_mmap_private() as we keep
nommu_region_sem write-locked, so no-one can race with us by seeing a
transient region.

Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: Pekka Enberg <penberg@cs.helsinki.fi>
Acked-by: Paul Mundt <lethal@linux-sh.org>
Cc: Mel Gorman <mel@csn.ul.ie>
Acked-by: Greg Ungerer <gerg@snapgear.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

parent 4e49627b

mm/nommu.c

+1 −2

Original line number	Original line	Diff line number	Diff line
	@@ -1352,6 +1352,7 @@ unsigned long do_mmap_pgoff(struct file *file,
	}		}

	vma->vm_region = region;		vma->vm_region = region;
			add_nommu_region(region);

	/* set up the mapping */		/* set up the mapping */
	if (file && vma->vm_flags & VM_SHARED)		if (file && vma->vm_flags & VM_SHARED)
	@@ -1361,8 +1362,6 @@ unsigned long do_mmap_pgoff(struct file *file,
	if (ret < 0)		if (ret < 0)
	goto error_put_region;		goto error_put_region;

	add_nommu_region(region);

	/* okay... we have a mapping; now we have to register it */		/* okay... we have a mapping; now we have to register it */
	result = vma->vm_start;		result = vma->vm_start;

Admin message