lkml.org 
[lkml]   [2009]   [Feb]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[Patch] mmu_notifiers destroyed by __mmu_notifier_release() retain extra mm_count.

    An application relying upon mmu_notifier_release for teardown of the
    mmu_notifiers will leak mm_structs. At the do_mmu_notifier_register
    increments mm_count, but __mmu_notifier_release() does not decrement it.

    Signed-off-by: Robin Holt <holt@sgi.com>
    CC: Stable kernel maintainers <stable@vger.kernel.org>

    ---

    I detected this while running a 2.6.27 kernel. Could this get added to
    the stable trees when accepted as well? It does cause a denial of
    service with OOM.

    mm/mmu_notifier.c | 1 +
    1 file changed, 1 insertion(+)

    Index: linux-2.6.27/mm/mmu_notifier.c
    ===================================================================
    --- linux-2.6.27.orig/mm/mmu_notifier.c 2008-10-09 17:13:53.000000000 -0500
    +++ linux-2.6.27/mm/mmu_notifier.c 2009-02-05 10:55:07.076561592 -0600
    @@ -61,6 +61,7 @@ void __mmu_notifier_release(struct mm_st
    if (mn->ops->release)
    mn->ops->release(mn, mm);
    rcu_read_unlock();
    + mmdrop(mm); /* matches do_mmu_notifier_register's inc */
    spin_lock(&mm->mmu_notifier_mm->lock);
    }
    spin_unlock(&mm->mmu_notifier_mm->lock);

    \
     
     \ /
      Last update: 2009-02-05 18:25    [W:4.647 / U:0.100 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site