* Peter Zijlstra <peterz@xxxxxxxxxxxxx> [2011-09-27 14:18:52]:
> On Tue, 2011-09-20 at 17:33 +0530, Srikar Dronamraju wrote:
> > +static struct uprobes_xol_area *xol_alloc_area(void)
> > +{
> > + struct uprobes_xol_area *area = NULL;
> > +
> > + area = kzalloc(sizeof(*area), GFP_KERNEL);
> > + if (unlikely(!area))
> > + return NULL;
> > +
> > + area->bitmap = kzalloc(BITS_TO_LONGS(UINSNS_PER_PAGE) * sizeof(long),
> > + GFP_KERNEL);
> > +
> > + if (!area->bitmap)
> > + goto fail;
> > +
> > + init_waitqueue_head(&area->wq);
> > + spin_lock_init(&area->slot_lock);
> > + if (!xol_add_vma(area) && !current->mm->uprobes_xol_area) {
>
> So what happens if xol_add_vma() succeeds, but we find
> ->uprobes_xol_area set?
>
> > + task_lock(current);
> > + if (!current->mm->uprobes_xol_area) {
>
> Having to re-test it under this lock seems to suggest it could.
>
> > + current->mm->uprobes_xol_area = area;
> > + task_unlock(current);
> > + return area;
>
> This function would be so much easier to read if the success case (this
> here I presume) would not be nested 2 deep.
>
> > + }
> > + task_unlock(current);
> > + }
>
> at which point you could end up with two extra vmas? Because there's no
> freeing of the result of xol_add_vma().
>
Agree, we need to unmap the vma in that case.
> > +fail:
> > + kfree(area->bitmap);
> > + kfree(area);
> > + return current->mm->uprobes_xol_area;
> > +}
--
Thanks and Regards
Srikar
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@xxxxxxxxx. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Fight unfair telecom internet charges in Canada: sign http://stopthemeter.ca/
Don't email: <a href=mailto:"dont@xxxxxxxxx";> email@xxxxxxxxx </a>