fs/exec.c: fix minor memory leak

[Andrew Morton <akpm@linux-foundation.org>]

Could someone please double-check this?


From: Andrew Morton <akpm@linux-foundation.org>
Subject: fs/exec.c: fix minor memory leak

When the to-be-removed argument's trailing '\0' is the final byte in the
page, remove_arg_zero()'s logic will avoid freeing the page, will break
from the loop and will then advance bprm->p to point at the first byte in
the next page.  Net result: the final page for the zeroeth argument is
unfreed.

It isn't a very important leak - that page will be freed later by the
bprm-wide sweep in free_arg_pages().

Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=116841
Reported by: hujunjie <jj.net@163.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 fs/exec.c |    9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff -puN fs/exec.c~fs-execc-fix-minor-memory-leak fs/exec.c
--- a/fs/exec.c~fs-execc-fix-minor-memory-leak
+++ a/fs/exec.c
@@ -1482,8 +1482,15 @@ int remove_arg_zero(struct linux_binprm
 		kunmap_atomic(kaddr);
 		put_arg_page(page);
 
-		if (offset == PAGE_SIZE)
+		if (offset == PAGE_SIZE) {
 			free_arg_page(bprm, (bprm->p >> PAGE_SHIFT) - 1);
+		} else if (offset == PAGE_SIZE - 1) {
+			/*
+			 * The trailing '\0' is the last byte in a page - we're
+			 * about to advance past that byte so free its page now
+			 */
+			free_arg_page(bprm, (bprm->p >> PAGE_SHIFT));
+		}
 	} while (offset == PAGE_SIZE);
 
 	bprm->p++;
_

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>