Commit c4ea95d7cd08d9ffd7fa75e6c5e0332d596dd11e
Committed by
Linus Torvalds
1 parent
2022b4d18a
Exists in
ti-lsk-linux-4.1.y
and in
10 other branches
mm: fix anon_vma_clone() error treatment
Andrew Morton noticed that the error return from anon_vma_clone() was being dropped and replaced with -ENOMEM (which is not itself a bug because the only error return value from anon_vma_clone() is -ENOMEM). I did an audit of callers of anon_vma_clone() and discovered an actual bug where the error return was being lost. In __split_vma(), between Linux 3.11 and 3.12 the code was changed so the err variable is used before the call to anon_vma_clone() and the default initial value of -ENOMEM is overwritten. So a failure of anon_vma_clone() will return success since err at this point is now zero. Below is a patch which fixes this bug and also propagates the error return value from anon_vma_clone() in all cases. Fixes: ef0855d334e1 ("mm: mempolicy: turn vma_set_policy() into vma_dup_policy()") Signed-off-by: Daniel Forrest <dan.forrest@ssec.wisc.edu> Reviewed-by: Michal Hocko <mhocko@suse.cz> Cc: Konstantin Khlebnikov <koct9i@gmail.com> Cc: Andrea Arcangeli <aarcange@redhat.com> Cc: Rik van Riel <riel@redhat.com> Cc: Tim Hartrick <tim@edgecast.com> Cc: Hugh Dickins <hughd@google.com> Cc: Michel Lespinasse <walken@google.com> Cc: Vlastimil Babka <vbabka@suse.cz> Cc: <stable@vger.kernel.org> [3.12+] Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Showing 2 changed files with 11 additions and 5 deletions Side-by-side Diff
mm/mmap.c
... | ... | @@ -776,8 +776,11 @@ |
776 | 776 | * shrinking vma had, to cover any anon pages imported. |
777 | 777 | */ |
778 | 778 | if (exporter && exporter->anon_vma && !importer->anon_vma) { |
779 | - if (anon_vma_clone(importer, exporter)) | |
780 | - return -ENOMEM; | |
779 | + int error; | |
780 | + | |
781 | + error = anon_vma_clone(importer, exporter); | |
782 | + if (error) | |
783 | + return error; | |
781 | 784 | importer->anon_vma = exporter->anon_vma; |
782 | 785 | } |
783 | 786 | } |
... | ... | @@ -2469,7 +2472,8 @@ |
2469 | 2472 | if (err) |
2470 | 2473 | goto out_free_vma; |
2471 | 2474 | |
2472 | - if (anon_vma_clone(new, vma)) | |
2475 | + err = anon_vma_clone(new, vma); | |
2476 | + if (err) | |
2473 | 2477 | goto out_free_mpol; |
2474 | 2478 | |
2475 | 2479 | if (new->vm_file) |
mm/rmap.c
... | ... | @@ -274,6 +274,7 @@ |
274 | 274 | { |
275 | 275 | struct anon_vma_chain *avc; |
276 | 276 | struct anon_vma *anon_vma; |
277 | + int error; | |
277 | 278 | |
278 | 279 | /* Don't bother if the parent process has no anon_vma here. */ |
279 | 280 | if (!pvma->anon_vma) |
... | ... | @@ -283,8 +284,9 @@ |
283 | 284 | * First, attach the new VMA to the parent VMA's anon_vmas, |
284 | 285 | * so rmap can find non-COWed pages in child processes. |
285 | 286 | */ |
286 | - if (anon_vma_clone(vma, pvma)) | |
287 | - return -ENOMEM; | |
287 | + error = anon_vma_clone(vma, pvma); | |
288 | + if (error) | |
289 | + return error; | |
288 | 290 | |
289 | 291 | /* Then add our own anon_vma. */ |
290 | 292 | anon_vma = anon_vma_alloc(); |