Messages in this thread Patch in this message | | | Date | Fri, 06 Nov 2009 13:56:14 -0800 | From | Greg KH <> | Subject | [11/30] mbind(): fix leak of never putback pages |
| |
2.6.29-stable review patch. If anyone has any objections, please let us know.
------------------ From: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
commit ab8a3e14e6f8e567560f664bbd29aefb306a274e upstream.
If mbind() receives an invalid address, do_mbind leaks a page. The following test program detects this leak.
This patch fixes it.
migrate_efault.c ======================================= #include <numaif.h> #include <numa.h> #include <sys/mman.h> #include <stdio.h> #include <unistd.h> #include <stdlib.h> #include <string.h>
static unsigned long pagesize;
static void* make_hole_mapping(void) {
void* addr;
addr = mmap(NULL, pagesize*3, PROT_READ|PROT_WRITE, MAP_ANON|MAP_PRIVATE, 0, 0); if (addr == MAP_FAILED) return NULL;
/* make page populate */ memset(addr, 0, pagesize*3);
/* make memory hole */ munmap(addr+pagesize, pagesize);
return addr; }
int main(int argc, char** argv) { void* addr; int ch; int node; struct bitmask *nmask = numa_allocate_nodemask(); int err; int node_set = 0;
while ((ch = getopt(argc, argv, "n:")) != -1){ switch (ch){ case 'n': node = strtol(optarg, NULL, 0); numa_bitmask_setbit(nmask, node); node_set = 1; break; default: ; } } argc -= optind; argv += optind;
if (!node_set) numa_bitmask_setbit(nmask, 0);
pagesize = getpagesize();
addr = make_hole_mapping();
err = mbind(addr, pagesize*3, MPOL_BIND, nmask->maskp, nmask->size, MPOL_MF_MOVE_ALL); if (err) perror("mbind ");
return 0; } =======================================
Signed-off-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com> Acked-by: Christoph Lameter <cl@linux-foundation.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
--- mm/mempolicy.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
--- a/mm/mempolicy.c +++ b/mm/mempolicy.c @@ -985,7 +985,8 @@ static long do_mbind(unsigned long start if (!err && nr_failed && (flags & MPOL_MF_STRICT)) err = -EIO; - } + } else + putback_lru_pages(&pagelist); up_write(&mm->mmap_sem); mpol_put(new);
| |