[PATCH 3.14 37/43] ioctx_alloc(): fix vma (and file) leak on failure
3.14-stable review patch. If anyone has any objections, please let me know.
--
From: Al Viro
commit deeb8525f9bcea60f5e86521880c1161de7a5829 upstream.
If we fail past the aio_setup_ring(), we need to destroy the
mapping. We don't need to care about anybody having found ctx,
or added requests to it, since the last failure exit is exactly
the failure to make ctx visible to lookups.
Reproducer (based on one by Joe Mario ):
void count(char *p)
{
char s[80];
printf("%s: ", p);
fflush(stdout);
sprintf(s, "/bin/cat /proc/%d/maps|/bin/fgrep -c '/[aio] (deleted)'",
getpid());
system(s);
}
int main()
{
io_context_t *ctx;
int created, limit, i, destroyed;
FILE *f;
count("before");
if ((f = fopen("/proc/sys/fs/aio-max-nr", "r")) == NULL)
perror("opening aio-max-nr");
else if (fscanf(f, "%d", ) != 1)
fprintf(stderr, "can't parse aio-max-nr\n");
else if ((ctx = calloc(limit, sizeof(io_context_t))) == NULL)
perror("allocating aio_context_t array");
else {
for (i = 0, created = 0; i < limit; i++) {
if (io_setup(1000, ctx + created) == 0)
created++;
}
for (i = 0, destroyed = 0; i < created; i++)
if (io_destroy(ctx[i]) == 0)
destroyed++;
printf("created %d, failed %d, destroyed %d\n",
created, limit - created, destroyed);
count("after");
}
}
Found-by: Joe Mario
Signed-off-by: Al Viro
Signed-off-by: Greg Kroah-Hartman
---
fs/aio.c |3 +++
1 file changed, 3 insertions(+)
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -719,6 +719,9 @@ static struct kioctx *ioctx_alloc(unsign
err_cleanup:
aio_nr_sub(ctx->max_reqs);
err_ctx:
+ atomic_set(>dead, 1);
+ if (ctx->mmap_size)
+ vm_munmap(ctx->mmap_base, ctx->mmap_size);
aio_free_ring(ctx);
err:
mutex_unlock(>ring_lock);
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[PATCH 3.14 37/43] ioctx_alloc(): fix vma (and file) leak on failure
3.14-stable review patch. If anyone has any objections, please let me know.
--
From: Al Viro v...@zeniv.linux.org.uk
commit deeb8525f9bcea60f5e86521880c1161de7a5829 upstream.
If we fail past the aio_setup_ring(), we need to destroy the
mapping. We don't need to care about anybody having found ctx,
or added requests to it, since the last failure exit is exactly
the failure to make ctx visible to lookups.
Reproducer (based on one by Joe Mario jma...@redhat.com):
void count(char *p)
{
char s[80];
printf(%s: , p);
fflush(stdout);
sprintf(s, /bin/cat /proc/%d/maps|/bin/fgrep -c '/[aio] (deleted)',
getpid());
system(s);
}
int main()
{
io_context_t *ctx;
int created, limit, i, destroyed;
FILE *f;
count(before);
if ((f = fopen(/proc/sys/fs/aio-max-nr, r)) == NULL)
perror(opening aio-max-nr);
else if (fscanf(f, %d, limit) != 1)
fprintf(stderr, can't parse aio-max-nr\n);
else if ((ctx = calloc(limit, sizeof(io_context_t))) == NULL)
perror(allocating aio_context_t array);
else {
for (i = 0, created = 0; i limit; i++) {
if (io_setup(1000, ctx + created) == 0)
created++;
}
for (i = 0, destroyed = 0; i created; i++)
if (io_destroy(ctx[i]) == 0)
destroyed++;
printf(created %d, failed %d, destroyed %d\n,
created, limit - created, destroyed);
count(after);
}
}
Found-by: Joe Mario jma...@redhat.com
Signed-off-by: Al Viro v...@zeniv.linux.org.uk
Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org
---
fs/aio.c |3 +++
1 file changed, 3 insertions(+)
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -719,6 +719,9 @@ static struct kioctx *ioctx_alloc(unsign
err_cleanup:
aio_nr_sub(ctx-max_reqs);
err_ctx:
+ atomic_set(ctx-dead, 1);
+ if (ctx-mmap_size)
+ vm_munmap(ctx-mmap_base, ctx-mmap_size);
aio_free_ring(ctx);
err:
mutex_unlock(ctx-ring_lock);
--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
