Messages in this thread Patch in this message | | | Date | Wed, 29 Apr 2009 15:07:44 -0700 | From | Greg KH <> | Subject | [patch 45/58] mm: check for no mmaps in exit_mmap() |
| |
2.6.27-stable review patch. If anyone has any objections, please let us know.
------------------
From: Johannes Weiner <hannes@cmpxchg.org>
commit dcd4a049b9751828c516c59709f3fdf50436df85 upstream.
When dup_mmap() ooms we can end up with mm->mmap == NULL. The error path does mmput() and unmap_vmas() gets a NULL vma which it dereferences.
In exit_mmap() there is nothing to do at all for this case, we can cancel the callpath right there.
[akpm@linux-foundation.org: add sorely-needed comment] Signed-off-by: Johannes Weiner <hannes@cmpxchg.org> Reported-by: Akinobu Mita <akinobu.mita@gmail.com> Cc: Nick Piggin <nickpiggin@yahoo.com.au> Cc: Hugh Dickins <hugh@veritas.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Reported-by: Kir Kolyshkin <kir@openvz.org> Tested-by: Kir Kolyshkin <kir@openvz.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
--- mm/mmap.c | 3 +++ 1 file changed, 3 insertions(+)
--- a/mm/mmap.c +++ b/mm/mmap.c @@ -2068,6 +2068,9 @@ void exit_mmap(struct mm_struct *mm) arch_exit_mmap(mm); mmu_notifier_release(mm); + if (!mm->mmap) /* Can happen if dup_mmap() received an OOM */ + return; + lru_add_drain(); flush_cache_mm(mm); tlb = tlb_gather_mmu(mm, 1);
| |