Re: [PATCH] error path in setup_arg_pages() misses vm_unacct_memory()

[Kirill Korotaev <dev@sw.ru>]

[-- Attachment #1: Type: text/plain, Size: 1881 bytes --]

>>Kirill Korotaev <dev@sw.ru> wrote:
>>
>>> This patch fixes error path in setup_arg_pages() functions, since it 
>>> misses vm_unacct_memory() after successful call of 
>>> security_vm_enough_memory(). Also it cleans up error path.
>>
>>Ugh.  The identifier `security_vm_enough_memory()' sounds like some
>>predicate which has no side-effects.  Except it performs accounting.  Hence
>>bugs like this.
>>
>>It's a shame that you mixed a largeish cleanup along with a bugfix - please
>>don't do that in future.
>>
>>Patch looks OK to me.  Hugh, could you please double-check sometime?
> 
> 
> It's a good find, and the patch looks correct to me, so far as it goes.
> But I think it's the wrong patch, and incomplete: it can be done more
> appropriately, more simply and more completely in insert_vm_struct itself.
> I'll post a replacement patch (or admit I'm wrong) in a little while.

this looks like the weirdest solution to me...
also it looks like not all the callers of insert_vm_struct do call 
security_vm_enough_memory(), e.g. ./arch/sparc/mm/sun4c.c

------------------------------------------------------------------

Also, Pavel missed ppc64 version of setup_arg_pages due to different 
name. I attached 2 new additional patches:



1. diff-ms-ppsleak-20050913:

[PATCH] error path in ppc64::arch_setup_additional_pages() misses 
vm_unacct_memory() and kmem_cache_free()

This patch fixes error path in arch_setup_additional_pages() function, 
since it misses vm_unacct_memory() and kmmem_cache_free() after 
successful call of security_vm_enough_memory().

Signed-Off-By: Pavel Emelianov <xemul@sw.ru>
Signed-Off-By: Kirill Korotaev <dev@sw.ru>



2. diff-ms-ppscleanup-20050913:
[PATCH] This patch cleanups error path in 
ppc64::arch_setup_additional_pages() function.

Signed-Off-By: Pavel Emelianov <xemul@sw.ru>
Signed-Off-By: Kirill Korotaev <dev@sw.ru>



Kirill

[-- Attachment #2: diff-ms-ppsleak-20050913 --]
[-- Type: text/plain, Size: 539 bytes --]

--- linux-2.6.13.1/arch/ppc64/kernel/vdso.c.ppcfix	2005-09-13 15:44:17.000000000 +0400
+++ linux-2.6.13.1/arch/ppc64/kernel/vdso.c	2005-09-13 15:47:26.000000000 +0400
@@ -237,8 +237,11 @@ int arch_setup_additional_pages(struct l
 	 */
 	vdso_base = get_unmapped_area(NULL, vdso_base,
 				      vdso_pages << PAGE_SHIFT, 0, 0);
-	if (vdso_base & ~PAGE_MASK)
+	if (vdso_base & ~PAGE_MASK) {
+		vm_unacct_memory(vdso_pages);
+		kmem_cache_free(vm_area_cachep, vma);
 		return (int)vdso_base;
+	}
 
 	current->thread.vdso_base = vdso_base;
 

[-- Attachment #3: diff-ms-ppscleanup-20050913 --]
[-- Type: text/plain, Size: 1317 bytes --]

--- linux-2.6.13.1/arch/ppc64/kernel/vdso.c.ppccln	2005-09-13 15:47:26.000000000 +0400
+++ linux-2.6.13.1/arch/ppc64/kernel/vdso.c	2005-09-13 15:55:08.000000000 +0400
@@ -221,13 +221,13 @@ int arch_setup_additional_pages(struct l
 	if (vdso_pages == 0)
 		return 0;
 
+	vdso_base = -ENOMEM;
 	vma = kmem_cache_alloc(vm_area_cachep, SLAB_KERNEL);
 	if (vma == NULL)
-		return -ENOMEM;
-	if (security_vm_enough_memory(vdso_pages)) {
-		kmem_cache_free(vm_area_cachep, vma);
-		return -ENOMEM;
-	}
+		goto out;
+	if (security_vm_enough_memory(vdso_pages))
+		goto out_free;
+
 	memset(vma, 0, sizeof(*vma));
 
 	/*
@@ -237,11 +237,8 @@ int arch_setup_additional_pages(struct l
 	 */
 	vdso_base = get_unmapped_area(NULL, vdso_base,
 				      vdso_pages << PAGE_SHIFT, 0, 0);
-	if (vdso_base & ~PAGE_MASK) {
-		vm_unacct_memory(vdso_pages);
-		kmem_cache_free(vm_area_cachep, vma);
-		return (int)vdso_base;
-	}
+	if (vdso_base & ~PAGE_MASK)
+		goto out_unacct;
 
 	current->thread.vdso_base = vdso_base;
 
@@ -274,6 +271,13 @@ int arch_setup_additional_pages(struct l
 	up_write(&mm->mmap_sem);
 
 	return 0;
+
+out_unacct:
+	vm_unacct_memory(vdso_pages);
+out_free:
+	kmem_cache_free(vm_area_cachep, vma);
+out:
+	return (int)vdso_base;
 }
 
 static void * __init find_section32(Elf32_Ehdr *ehdr, const char *secname,