lkml.org 
[lkml]   [2002]   [Aug]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
Subject[PATCH] mremap corrupts freed vma
My tricksy accounting code in mremap's move_vma assumed 2.4 behaviour
in do_munmap, which preserved vma: but 2.5 splitvma may substitute it.
Showed up as Committed_AS growing each time kernel built with kallsyms;
but more seriously, it was writing to an area already kmem_cache_freed.

Patch against 2.5.31 or today's BK: please apply before others corrupted!

--- 2.5.31/mm/mremap.c Fri Aug 2 21:15:57 2002
+++ linux/mm/mremap.c Mon Aug 19 22:13:33 2002
@@ -220,6 +220,8 @@
split = 1;
} else if (addr + old_len == vma->vm_end)
vma = NULL; /* it will be removed */
+ else
+ split = -1; /* vma may be changed */
} else
vma = NULL; /* nothing more to do */

@@ -227,8 +229,10 @@

/* Restore VM_ACCOUNT if one or two pieces of vma left */
if (vma) {
+ if (split < 0)
+ vma = find_vma(mm, addr + old_len);
vma->vm_flags |= VM_ACCOUNT;
- if (split)
+ if (split > 0)
vma->vm_next->vm_flags |= VM_ACCOUNT;
}
current->mm->total_vm += new_len >> PAGE_SHIFT;
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:28    [W:0.040 / U:1.480 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site