aboutsummaryrefslogtreecommitdiffstats
path: root/arch/mips
diff options
context:
space:
mode:
authorHugh Dickins <hugh@veritas.com>2005-09-14 01:13:02 -0400
committerLinus Torvalds <torvalds@g5.osdl.org>2005-09-14 14:18:13 -0400
commit2fd4ef85e0db9ed75c98e13953257a967ea55e03 (patch)
tree119dfe9f88a832f3db6ff66e631112626f268f18 /arch/mips
parentfb085cf1d4294824571815d487daccc0609543f0 (diff)
[PATCH] error path in setup_arg_pages() misses vm_unacct_memory()
Pavel Emelianov and Kirill Korotaev observe that fs and arch users of security_vm_enough_memory tend to forget to vm_unacct_memory when a failure occurs further down (typically in setup_arg_pages variants). These are all users of insert_vm_struct, and that reservation will only be unaccounted on exit if the vma is marked VM_ACCOUNT: which in some cases it is (hidden inside VM_STACK_FLAGS) and in some cases it isn't. So x86_64 32-bit and ppc64 vDSO ELFs have been leaking memory into Committed_AS each time they're run. But don't add VM_ACCOUNT to them, it's inappropriate to reserve against the very unlikely case that gdb be used to COW a vDSO page - we ought to do something about that in do_wp_page, but there are yet other inconsistencies to be resolved. The safe and economical way to fix this is to let insert_vm_struct do the security_vm_enough_memory check when it finds VM_ACCOUNT is set. And the MIPS irix_brk has been calling security_vm_enough_memory before calling do_brk which repeats it, doubly accounting and so also leaking. Remove that, and all the fs and arch calls to security_vm_enough_memory: give it a less misleading name later on. Signed-off-by: Hugh Dickins <hugh@veritas.com> Signed-Off-By: Kirill Korotaev <dev@sw.ru> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Diffstat (limited to 'arch/mips')
-rw-r--r--arch/mips/kernel/sysirix.c9
1 files changed, 2 insertions, 7 deletions
diff --git a/arch/mips/kernel/sysirix.c b/arch/mips/kernel/sysirix.c
index 4de155699c4f..7ae4af476974 100644
--- a/arch/mips/kernel/sysirix.c
+++ b/arch/mips/kernel/sysirix.c
@@ -581,18 +581,13 @@ asmlinkage int irix_brk(unsigned long brk)
581 } 581 }
582 582
583 /* 583 /*
584 * Check if we have enough memory.. 584 * Ok, looks good - let it rip.
585 */ 585 */
586 if (security_vm_enough_memory((newbrk-oldbrk) >> PAGE_SHIFT)) { 586 if (do_brk(oldbrk, newbrk-oldbrk) != oldbrk) {
587 ret = -ENOMEM; 587 ret = -ENOMEM;
588 goto out; 588 goto out;
589 } 589 }
590
591 /*
592 * Ok, looks good - let it rip.
593 */
594 mm->brk = brk; 590 mm->brk = brk;
595 do_brk(oldbrk, newbrk-oldbrk);
596 ret = 0; 591 ret = 0;
597 592
598out: 593out: