Messages in this thread Patches in this message | | | Date | Tue, 13 Sep 2005 16:13:57 +0400 | From | Kirill Korotaev <> | Subject | Re: [PATCH] error path in setup_arg_pages() misses vm_unacct_memory() |
| |
>>Kirill Korotaev <dev@sw.ru> wrote: >> >>> This patch fixes error path in setup_arg_pages() functions, since it >>> misses vm_unacct_memory() after successful call of >>> security_vm_enough_memory(). Also it cleans up error path. >> >>Ugh. The identifier `security_vm_enough_memory()' sounds like some >>predicate which has no side-effects. Except it performs accounting. Hence >>bugs like this. >> >>It's a shame that you mixed a largeish cleanup along with a bugfix - please >>don't do that in future. >> >>Patch looks OK to me. Hugh, could you please double-check sometime? > > > It's a good find, and the patch looks correct to me, so far as it goes. > But I think it's the wrong patch, and incomplete: it can be done more > appropriately, more simply and more completely in insert_vm_struct itself. > I'll post a replacement patch (or admit I'm wrong) in a little while.
this looks like the weirdest solution to me... also it looks like not all the callers of insert_vm_struct do call security_vm_enough_memory(), e.g. ./arch/sparc/mm/sun4c.c
------------------------------------------------------------------
Also, Pavel missed ppc64 version of setup_arg_pages due to different name. I attached 2 new additional patches:
1. diff-ms-ppsleak-20050913:
[PATCH] error path in ppc64::arch_setup_additional_pages() misses vm_unacct_memory() and kmem_cache_free()
This patch fixes error path in arch_setup_additional_pages() function, since it misses vm_unacct_memory() and kmmem_cache_free() after successful call of security_vm_enough_memory().
Signed-Off-By: Pavel Emelianov <xemul@sw.ru> Signed-Off-By: Kirill Korotaev <dev@sw.ru>
2. diff-ms-ppscleanup-20050913: [PATCH] This patch cleanups error path in ppc64::arch_setup_additional_pages() function.
Signed-Off-By: Pavel Emelianov <xemul@sw.ru> Signed-Off-By: Kirill Korotaev <dev@sw.ru>
Kirill --- linux-2.6.13.1/arch/ppc64/kernel/vdso.c.ppcfix 2005-09-13 15:44:17.000000000 +0400 +++ linux-2.6.13.1/arch/ppc64/kernel/vdso.c 2005-09-13 15:47:26.000000000 +0400 @@ -237,8 +237,11 @@ int arch_setup_additional_pages(struct l */ vdso_base = get_unmapped_area(NULL, vdso_base, vdso_pages << PAGE_SHIFT, 0, 0); - if (vdso_base & ~PAGE_MASK) + if (vdso_base & ~PAGE_MASK) { + vm_unacct_memory(vdso_pages); + kmem_cache_free(vm_area_cachep, vma); return (int)vdso_base; + } current->thread.vdso_base = vdso_base; --- linux-2.6.13.1/arch/ppc64/kernel/vdso.c.ppccln 2005-09-13 15:47:26.000000000 +0400 +++ linux-2.6.13.1/arch/ppc64/kernel/vdso.c 2005-09-13 15:55:08.000000000 +0400 @@ -221,13 +221,13 @@ int arch_setup_additional_pages(struct l if (vdso_pages == 0) return 0; + vdso_base = -ENOMEM; vma = kmem_cache_alloc(vm_area_cachep, SLAB_KERNEL); if (vma == NULL) - return -ENOMEM; - if (security_vm_enough_memory(vdso_pages)) { - kmem_cache_free(vm_area_cachep, vma); - return -ENOMEM; - } + goto out; + if (security_vm_enough_memory(vdso_pages)) + goto out_free; + memset(vma, 0, sizeof(*vma)); /* @@ -237,11 +237,8 @@ int arch_setup_additional_pages(struct l */ vdso_base = get_unmapped_area(NULL, vdso_base, vdso_pages << PAGE_SHIFT, 0, 0); - if (vdso_base & ~PAGE_MASK) { - vm_unacct_memory(vdso_pages); - kmem_cache_free(vm_area_cachep, vma); - return (int)vdso_base; - } + if (vdso_base & ~PAGE_MASK) + goto out_unacct; current->thread.vdso_base = vdso_base; @@ -274,6 +271,13 @@ int arch_setup_additional_pages(struct l up_write(&mm->mmap_sem); return 0; + +out_unacct: + vm_unacct_memory(vdso_pages); +out_free: + kmem_cache_free(vm_area_cachep, vma); +out: + return (int)vdso_base; } static void * __init find_section32(Elf32_Ehdr *ehdr, const char *secname, | |