[Patch] mmu_notifiers destroyed by __mmu_notifier_release() retain extra mm_count.

[Robin Holt <holt@sgi.com>]

An application relying upon mmu_notifier_release for teardown of the
mmu_notifiers will leak mm_structs.  At the do_mmu_notifier_register
increments mm_count, but __mmu_notifier_release() does not decrement it.

Signed-off-by: Robin Holt <holt@sgi.com>
CC: Stable kernel maintainers <stable@vger.kernel.org>

---

I detected this while running a 2.6.27 kernel.  Could this get added to
the stable trees when accepted as well?  It does cause a denial of
service with OOM.

 mm/mmu_notifier.c |    1 +
 1 file changed, 1 insertion(+)

Index: linux-2.6.27/mm/mmu_notifier.c
===================================================================
--- linux-2.6.27.orig/mm/mmu_notifier.c	2008-10-09 17:13:53.000000000 -0500
+++ linux-2.6.27/mm/mmu_notifier.c	2009-02-05 10:55:07.076561592 -0600
@@ -61,6 +61,7 @@ void __mmu_notifier_release(struct mm_st
 		if (mn->ops->release)
 			mn->ops->release(mn, mm);
 		rcu_read_unlock();
+		mmdrop(mm);	/* matches do_mmu_notifier_register's inc */
 		spin_lock(&mm->mmu_notifier_mm->lock);
 	}
 	spin_unlock(&mm->mmu_notifier_mm->lock);