pte_chain leak in rmap code (2.5.31)

From: Christian Ehrhardt (ehrhardt@mathematik.uni-ulm.de)
Date: Mon Aug 12 2002 - 08:45:27 EST

Hi,

While browsing through rmap.c in 2.5.31 I found what looks like a
bug introduced by the PageDirect optimizations. Look at the following
piece of code in try_to_unmap:

        for (pc = page->pte.chain; pc; pc = next_pc) {
                next_pc = pc->next;
                switch (try_to_unmap_one(page, pc->ptep)) {
                        case SWAP_SUCCESS:
                                /* Free the pte_chain struct. */
                                pte_chain_free(pc, prev_pc, page);
                                break;
                        case SWAP_AGAIN:
                                /* Skip this pte, remembering status. */
                                prev_pc = pc;
                                ret = SWAP_AGAIN;
                                continue;
                        case SWAP_FAIL:
                                ret = SWAP_FAIL;
                                break;
                        case SWAP_ERROR:
                                ret = SWAP_ERROR;
                                break;
                }
        }

Note the strange use of continue and break which both achieve the same!
What was meant to happen (judging from rmap-13c) is that we break
out of the for-Loop once SWAP_FAIL or SWAP_ERROR is returned from
try_to_unmap_one. However, this doesn't happen and a subsequent call
to pte_chain_free will use the wrong value for prev_pc.

The impact seems to be at least leakage of pte_chain structures.

I propose the following (untested) patch:

--- rmap.c Sun Aug 11 03:41:54 2002
+++ /home/ehrhardt/rmap.c Mon Aug 12 15:49:25 2002
@@ -336,9 +336,11 @@
                                        continue;
                                case SWAP_FAIL:
                                        ret = SWAP_FAIL;
+ pc = NULL
                                        break;
                                case SWAP_ERROR:
                                        ret = SWAP_ERROR;
+ pc = NULL
                                        break;
                        }
                }

   regards Christian Ehrhardt 

-- 
THAT'S ALL FOLKS!
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

This archive was generated by hypermail 2b29 : Thu Aug 15 2002 - 22:00:27 EST