On Tue, 12 Feb 2008, KOSAKI Motohiro wrote:

quoted text
> > @@ -218,21 +167,27 @@ static struct mempolicy *mpol_new(enum mempolicy_mode mode,
> >                 return ERR_PTR(-ENOMEM);
> >         flags &= MPOL_MODE_FLAGS;
> >         atomic_set(&policy->refcnt, 1);
> > +       cpuset_update_task_memory_state();
> > +       nodes_and(cpuset_context_nmask, *nodes, cpuset_current_mems_allowed);
> >         switch (mode) {
> >         case MPOL_INTERLEAVE:
> > -               policy->v.nodes = *nodes;
> > +               if (nodes_empty(*nodes))
> > +                       return ERR_PTR(-EINVAL);
> 
> need kmem_cache_free(policy_cache, policy) before return?
> 

Very good catch!



mempolicy: fix policy memory leak in mpol_new()

If mpol_new() cannot setup a new mempolicy because of an invalid argument
provided by the user, avoid leaking the mempolicy that has been dynamically
allocated.

Reported by KOSAKI Motohiro.

Cc: Paul Jackson <pj@sgi.com>
Cc: Christoph Lameter <clameter@sgi.com>
Cc: Lee Schermerhorn <Lee.Schermerhorn@hp.com>
Cc: Andi Kleen <ak@suse.de>
Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Signed-off-by: David Rientjes <rientjes@google.com>
---
 mm/mempolicy.c |   10 +++++-----
 1 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/mm/mempolicy.c b/mm/mempolicy.c
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -171,13 +171,11 @@ static struct mempolicy *mpol_new(enum mempolicy_mode mode,
 	nodes_and(cpuset_context_nmask, *nodes, cpuset_current_mems_allowed);
 	switch (mode) {
 	case MPOL_INTERLEAVE:
-		if (nodes_empty(*nodes))
-			return ERR_PTR(-EINVAL);
-		policy->v.nodes = cpuset_context_nmask;
-		if (nodes_weight(policy->v.nodes) == 0) {
+		if (nodes_empty(*nodes) || nodes_empty(cpuset_context_nmask)) {
 			kmem_cache_free(policy_cache, policy);
 			return ERR_PTR(-EINVAL);
 		}
+		policy->v.nodes = cpuset_context_nmask;
 		break;
 	case MPOL_PREFERRED:
 		policy->v.preferred_node = first_node(cpuset_context_nmask);
@@ -185,8 +183,10 @@ static struct mempolicy *mpol_new(enum mempolicy_mode mode,
 			policy->v.preferred_node = -1;
 		break;
 	case MPOL_BIND:
-		if (nodes_empty(*nodes))
+		if (nodes_empty(*nodes)) {
+			kmem_cache_free(policy_cache, policy);
 			return ERR_PTR(-EINVAL);
+		}
 		policy->v.zonelist = bind_zonelist(&cpuset_context_nmask);
 		if (IS_ERR(policy->v.zonelist)) {
 			void *error_code = policy->v.zonelist;
--
unsubscribe notice
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/