diff options
| author | Al Viro <viro@zeniv.linux.org.uk> | 2009-11-30 20:12:03 -0500 |
|---|---|---|
| committer | Al Viro <viro@zeniv.linux.org.uk> | 2009-12-11 06:44:57 -0500 |
| commit | 8c7b49b3ecd48923eb64ff57e07a1cdb74782970 (patch) | |
| tree | 3bb2335ccaa34ef227459800c2221e71cf6b1987 | |
| parent | f8b7256096a20436f6d0926747e3ac3d64c81d24 (diff) | |
| download | linux-8c7b49b3ecd48923eb64ff57e07a1cdb74782970.tar.bz2 | |
fix a struct file leak in do_mmap_pgoff()
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
| -rw-r--r-- | mm/mmap.c | 18 | ||||
| -rw-r--r-- | mm/util.c | 15 |
2 files changed, 15 insertions, 18 deletions
diff --git a/mm/mmap.c b/mm/mmap.c index 292ddc3cef9c..5076775a395c 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -948,24 +948,6 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr, if (mm->map_count > sysctl_max_map_count) return -ENOMEM; - if (flags & MAP_HUGETLB) { - struct user_struct *user = NULL; - if (file) - return -EINVAL; - - /* - * VM_NORESERVE is used because the reservations will be - * taken when vm_ops->mmap() is called - * A dummy user value is used because we are not locking - * memory so no accounting is necessary - */ - len = ALIGN(len, huge_page_size(&default_hstate)); - file = hugetlb_file_setup(HUGETLB_ANON_FILE, len, VM_NORESERVE, - &user, HUGETLB_ANONHUGE_INODE); - if (IS_ERR(file)) - return PTR_ERR(file); - } - /* Obtain the address to map to. we verify (or select) it and ensure * that it represents a valid section of the address space. */ diff --git a/mm/util.c b/mm/util.c index 3bf81b294ae8..b377ce430803 100644 --- a/mm/util.c +++ b/mm/util.c @@ -280,9 +280,24 @@ SYSCALL_DEFINE6(mmap_pgoff, unsigned long, addr, unsigned long, len, unsigned long retval = -EBADF; if (!(flags & MAP_ANONYMOUS)) { + if (unlikely(flags & MAP_HUGETLB)) + return -EINVAL; file = fget(fd); if (!file) goto out; + } else if (flags & MAP_HUGETLB) { + struct user_struct *user = NULL; + /* + * VM_NORESERVE is used because the reservations will be + * taken when vm_ops->mmap() is called + * A dummy user value is used because we are not locking + * memory so no accounting is necessary + */ + len = ALIGN(len, huge_page_size(&default_hstate)); + file = hugetlb_file_setup(HUGETLB_ANON_FILE, len, VM_NORESERVE, + &user, HUGETLB_ANONHUGE_INODE); + if (IS_ERR(file)) + return PTR_ERR(file); } flags &= ~(MAP_EXECUTABLE | MAP_DENYWRITE); |