• Hugh Dickins's avatar
    [PATCH] error path in setup_arg_pages() misses vm_unacct_memory() · 2fd4ef85
    Hugh Dickins authored
    Pavel Emelianov and Kirill Korotaev observe that fs and arch users of
    security_vm_enough_memory tend to forget to vm_unacct_memory when a
    failure occurs further down (typically in setup_arg_pages variants).
    
    These are all users of insert_vm_struct, and that reservation will only
    be unaccounted on exit if the vma is marked VM_ACCOUNT: which in some
    cases it is (hidden inside VM_STACK_FLAGS) and in some cases it isn't.
    
    So x86_64 32-bit and ppc64 vDSO ELFs have been leaking memory into
    Committed_AS each time they're run.  But don't add VM_ACCOUNT to them,
    it's inappropriate to reserve against the very unlikely case that gdb
    be used to COW a vDSO page - we ought to do something about that in
    do_wp_page, but there are yet other inconsistencies to be resolved.
    
    The safe and economical way to fix this is to let insert_vm_struct do
    the security_vm_enough_memory check when it finds VM_ACCOUNT is set.
    
    And the MIPS irix_brk has been calling security_vm_enough_memory before
    calling do_brk which repeats it, doubly accounting and so also leaking.
    Remove that, and all the fs and arch calls to security_vm_enough_memory:
    give it a less misleading name later on.
    Signed-off-by: default avatarHugh Dickins <hugh@veritas.com>
    Signed-Off-By: default avatarKirill Korotaev <dev@sw.ru>
    Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
    2fd4ef85
ia32_binfmt.c 11.8 KB