diff options
author | Hugh Dickins <hugh@veritas.com> | 2005-09-14 01:13:02 -0400 |
---|---|---|
committer | Linus Torvalds <torvalds@g5.osdl.org> | 2005-09-14 14:18:13 -0400 |
commit | 2fd4ef85e0db9ed75c98e13953257a967ea55e03 (patch) | |
tree | 119dfe9f88a832f3db6ff66e631112626f268f18 /arch/mips | |
parent | fb085cf1d4294824571815d487daccc0609543f0 (diff) |
[PATCH] error path in setup_arg_pages() misses vm_unacct_memory()
Pavel Emelianov and Kirill Korotaev observe that fs and arch users of
security_vm_enough_memory tend to forget to vm_unacct_memory when a
failure occurs further down (typically in setup_arg_pages variants).
These are all users of insert_vm_struct, and that reservation will only
be unaccounted on exit if the vma is marked VM_ACCOUNT: which in some
cases it is (hidden inside VM_STACK_FLAGS) and in some cases it isn't.
So x86_64 32-bit and ppc64 vDSO ELFs have been leaking memory into
Committed_AS each time they're run. But don't add VM_ACCOUNT to them,
it's inappropriate to reserve against the very unlikely case that gdb
be used to COW a vDSO page - we ought to do something about that in
do_wp_page, but there are yet other inconsistencies to be resolved.
The safe and economical way to fix this is to let insert_vm_struct do
the security_vm_enough_memory check when it finds VM_ACCOUNT is set.
And the MIPS irix_brk has been calling security_vm_enough_memory before
calling do_brk which repeats it, doubly accounting and so also leaking.
Remove that, and all the fs and arch calls to security_vm_enough_memory:
give it a less misleading name later on.
Signed-off-by: Hugh Dickins <hugh@veritas.com>
Signed-Off-By: Kirill Korotaev <dev@sw.ru>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Diffstat (limited to 'arch/mips')
-rw-r--r-- | arch/mips/kernel/sysirix.c | 9 |
1 files changed, 2 insertions, 7 deletions
diff --git a/arch/mips/kernel/sysirix.c b/arch/mips/kernel/sysirix.c index 4de155699c4f..7ae4af476974 100644 --- a/arch/mips/kernel/sysirix.c +++ b/arch/mips/kernel/sysirix.c | |||
@@ -581,18 +581,13 @@ asmlinkage int irix_brk(unsigned long brk) | |||
581 | } | 581 | } |
582 | 582 | ||
583 | /* | 583 | /* |
584 | * Check if we have enough memory.. | 584 | * Ok, looks good - let it rip. |
585 | */ | 585 | */ |
586 | if (security_vm_enough_memory((newbrk-oldbrk) >> PAGE_SHIFT)) { | 586 | if (do_brk(oldbrk, newbrk-oldbrk) != oldbrk) { |
587 | ret = -ENOMEM; | 587 | ret = -ENOMEM; |
588 | goto out; | 588 | goto out; |
589 | } | 589 | } |
590 | |||
591 | /* | ||
592 | * Ok, looks good - let it rip. | ||
593 | */ | ||
594 | mm->brk = brk; | 590 | mm->brk = brk; |
595 | do_brk(oldbrk, newbrk-oldbrk); | ||
596 | ret = 0; | 591 | ret = 0; |
597 | 592 | ||
598 | out: | 593 | out: |