rmap: fix anon_vma_fork() memory leak
authorRik van Riel <riel@redhat.com>
Mon, 5 Apr 2010 16:13:33 +0000 (12:13 -0400)
committerLinus Torvalds <torvalds@linux-foundation.org>
Mon, 5 Apr 2010 16:15:51 +0000 (09:15 -0700)
Fix a memory leak in anon_vma_fork(), where we fail to tear down the
anon_vmas attached to the new VMA in case setting up the new anon_vma
fails.

This bug also has the potential to leave behind anon_vma_chain structs
with pointers to invalid memory.

Reported-by: Minchan Kim <minchan.kim@gmail.com>
Signed-off-by: Rik van Riel <riel@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
mm/rmap.c

index fcd593c9c997153e78737fc9243d84499205590a..eaa7a09eb72e85b8f48911c8b3bf35e38d0e213c 100644 (file)
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -232,6 +232,7 @@ int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma)
  out_error_free_anon_vma:
        anon_vma_free(anon_vma);
  out_error:
+       unlink_anon_vmas(vma);
        return -ENOMEM;
 }