diff options
| author | Miaohe Lin <linmiaohe@huawei.com> | 2023-07-01 10:28:37 +0300 |
|---|---|---|
| committer | Andrew Morton <akpm@linux-foundation.org> | 2023-08-25 02:20:16 +0300 |
| commit | d51b68469bc7804c34622f7f3d4889628d37cfd6 (patch) | |
| tree | cf23abb613ee3caa2990a647eac8e032390015f1 /mm/memory-failure.c | |
| parent | 08dff2810e8feb3096bf5c8242ab1649d1e8b1a4 (diff) | |
| download | linux-d51b68469bc7804c34622f7f3d4889628d37cfd6.tar.xz | |
mm: memory-failure: fix potential page refcnt leak in memory_failure()
put_ref_page() is not called to drop extra refcnt when comes from madvise
in the case pfn is valid but pgmap is NULL leading to page refcnt leak.
Link: https://lkml.kernel.org/r/20230701072837.1994253-1-linmiaohe@huawei.com
Fixes: 1e8aaedb182d ("mm,memory_failure: always pin the page in madvise_inject_error")
Signed-off-by: Miaohe Lin <linmiaohe@huawei.com>
Acked-by: Naoya Horiguchi <naoya.horiguchi@nec.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Diffstat (limited to 'mm/memory-failure.c')
| -rw-r--r-- | mm/memory-failure.c | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/mm/memory-failure.c b/mm/memory-failure.c index 55dfe8a7bf4b..881c35ef1daa 100644 --- a/mm/memory-failure.c +++ b/mm/memory-failure.c @@ -2117,8 +2117,6 @@ static int memory_failure_dev_pagemap(unsigned long pfn, int flags, { int rc = -ENXIO; - put_ref_page(pfn, flags); - /* device metadata space is not recoverable */ if (!pgmap_pfn_valid(pgmap, pfn)) goto out; @@ -2193,6 +2191,7 @@ int memory_failure(unsigned long pfn, int flags) if (pfn_valid(pfn)) { pgmap = get_dev_pagemap(pfn, NULL); + put_ref_page(pfn, flags); if (pgmap) { res = memory_failure_dev_pagemap(pfn, flags, pgmap); |