Messages in this thread Patch in this message | | | Date | Thu, 5 Feb 2009 11:23:03 -0600 | From | Robin Holt <> | Subject | [Patch] mmu_notifiers destroyed by __mmu_notifier_release() retain extra mm_count. |
| |
An application relying upon mmu_notifier_release for teardown of the mmu_notifiers will leak mm_structs. At the do_mmu_notifier_register increments mm_count, but __mmu_notifier_release() does not decrement it.
Signed-off-by: Robin Holt <holt@sgi.com> CC: Stable kernel maintainers <stable@vger.kernel.org>
---
I detected this while running a 2.6.27 kernel. Could this get added to the stable trees when accepted as well? It does cause a denial of service with OOM.
mm/mmu_notifier.c | 1 + 1 file changed, 1 insertion(+)
Index: linux-2.6.27/mm/mmu_notifier.c =================================================================== --- linux-2.6.27.orig/mm/mmu_notifier.c 2008-10-09 17:13:53.000000000 -0500 +++ linux-2.6.27/mm/mmu_notifier.c 2009-02-05 10:55:07.076561592 -0600 @@ -61,6 +61,7 @@ void __mmu_notifier_release(struct mm_st if (mn->ops->release) mn->ops->release(mn, mm); rcu_read_unlock(); + mmdrop(mm); /* matches do_mmu_notifier_register's inc */ spin_lock(&mm->mmu_notifier_mm->lock); } spin_unlock(&mm->mmu_notifier_mm->lock);
| |