lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Mon, 6 May 2019 16:29:41 -0700 From: <rcampbell@...dia.com> To: <linux-mm@...ck.org> CC: <linux-kernel@...r.kernel.org>, Ralph Campbell <rcampbell@...dia.com>, John Hubbard <jhubbard@...dia.com>, Ira Weiny <ira.weiny@...el.com>, Dan Williams <dan.j.williams@...el.com>, Arnd Bergmann <arnd@...db.de>, Balbir Singh <bsingharora@...il.com>, Dan Carpenter <dan.carpenter@...cle.com>, Matthew Wilcox <willy@...radead.org>, Souptick Joarder <jrdr.linux@...il.com>, Andrew Morton <akpm@...ux-foundation.org> Subject: [PATCH 4/5] mm/hmm: hmm_vma_fault() doesn't always call hmm_range_unregister() From: Ralph Campbell <rcampbell@...dia.com> The helper function hmm_vma_fault() calls hmm_range_register() but is missing a call to hmm_range_unregister() in one of the error paths. This leads to a reference count leak and ultimately a memory leak on struct hmm. Always call hmm_range_unregister() if hmm_range_register() succeeded. Signed-off-by: Ralph Campbell <rcampbell@...dia.com> Cc: John Hubbard <jhubbard@...dia.com> Cc: Ira Weiny <ira.weiny@...el.com> Cc: Dan Williams <dan.j.williams@...el.com> Cc: Arnd Bergmann <arnd@...db.de> Cc: Balbir Singh <bsingharora@...il.com> Cc: Dan Carpenter <dan.carpenter@...cle.com> Cc: Matthew Wilcox <willy@...radead.org> Cc: Souptick Joarder <jrdr.linux@...il.com> Cc: Andrew Morton <akpm@...ux-foundation.org> --- include/linux/hmm.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/include/linux/hmm.h b/include/linux/hmm.h index 35a429621e1e..fa0671d67269 100644 --- a/include/linux/hmm.h +++ b/include/linux/hmm.h @@ -559,6 +559,7 @@ static inline int hmm_vma_fault(struct hmm_range *range, bool block) return (int)ret; if (!hmm_range_wait_until_valid(range, HMM_RANGE_DEFAULT_TIMEOUT)) { + hmm_range_unregister(range); /* * The mmap_sem was taken by driver we release it here and * returns -EAGAIN which correspond to mmap_sem have been @@ -570,13 +571,13 @@ static inline int hmm_vma_fault(struct hmm_range *range, bool block) ret = hmm_range_fault(range, block); if (ret <= 0) { + hmm_range_unregister(range); if (ret == -EBUSY || !ret) { /* Same as above, drop mmap_sem to match old API. */ up_read(&range->vma->vm_mm->mmap_sem); ret = -EBUSY; } else if (ret == -EAGAIN) ret = -EBUSY; - hmm_range_unregister(range); return ret; } return 0; -- 2.20.1
Powered by blists - more mailing lists