+ unlink_anon_vmas-in-__split_vma-in-case-of-error.patch added to -mm tree

+ unlink_anon_vmas-in-__split_vma-in-case-of-error.patch added to -mm tree

[akpm]

The patch titled
     mmap: call unlink_anon_vmas() in __split_vma() in case of error
has been added to the -mm tree.  Its filename is
     unlink_anon_vmas-in-__split_vma-in-case-of-error.patch

Before you just go and hit "reply", please:
   a) Consider who else should be cc'ed
   b) Prefer to cc a suitable mailing list as well
   c) Ideally: find the original patch on the mailing list and do a
      reply-to-all to that, adding suitable additional cc's

*** Remember to use Documentation/SubmitChecklist when testing your code ***

See http://userweb.kernel.org/~akpm/stuff/added-to-mm.txt to find
out what to do about this

The current -mm tree may be found at http://userweb.kernel.org/~akpm/mmotm/

------------------------------------------------------
Subject: mmap: call unlink_anon_vmas() in __split_vma() in case of error
From: Andrea Arcangeli <aarcange@redhat.com>

If __split_vma fails because of an out of memory condition the
anon_vma_chain isn't teardown and freed potentially leading to rmap walks
accessing freed vma information plus there's a memleak.

Signed-off-by: Andrea Arcangeli <aarcange@redhat.com>
Cc: Johannes Weiner <jweiner@redhat.com>
Cc: Rik van Riel <riel@redhat.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: Marcelo Tosatti <mtosatti@redhat.com>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 mm/mmap.c |    1 +
 1 file changed, 1 insertion(+)

diff -puN mm/mmap.c~unlink_anon_vmas-in-__split_vma-in-case-of-error mm/mmap.c
--- a/mm/mmap.c~unlink_anon_vmas-in-__split_vma-in-case-of-error
+++ a/mm/mmap.c
@@ -2009,6 +2009,7 @@ static int __split_vma(struct mm_struct 
 			removed_exe_file_vma(mm);
 		fput(new->vm_file);
 	}
+	unlink_anon_vmas(new);
  out_free_mpol:
 	mpol_put(pol);
  out_free_vma:
_

Patches currently in -mm which might be from aarcange@redhat.com are

linux-next.patch
rmap-fix-walk-during-fork.patch
unlink_anon_vmas-in-__split_vma-in-case-of-error.patch
define-madv_hugepage.patch
vmscan-do-not-writeback-filesystem-pages-in-direct-reclaim.patch
vmscan-kick-flusher-threads-to-clean-pages-when-reclaim-is-encountering-dirty-pages.patch