path: root/mm/pagewalk.c
diff options
authorLeon Yu <>2015-03-25 15:55:11 -0700
committerLinus Torvalds <>2015-03-25 16:20:30 -0700
commit3fe89b3e2a7bbf3e97657104b9b33a9d81b950b3 (patch)
tree989d39235f82bdd65c0e621d844d3db41b0690ec /mm/pagewalk.c
parentddd2a30d41a5bc578ab094f6dbf080697ea1a7dd (diff)
mm: fix anon_vma->degree underflow in anon_vma endless growing prevention
I have constantly stumbled upon "kernel BUG at mm/rmap.c:399!" after upgrading to 3.19 and had no luck with 4.0-rc1 neither. So, after looking into new logic introduced by commit 7a3ef208e662 ("mm: prevent endless growth of anon_vma hierarchy"), I found chances are that unlink_anon_vmas() is called without incrementing dst->anon_vma->degree in anon_vma_clone() due to allocation failure. If dst->anon_vma is not NULL in error path, its degree will be incorrectly decremented in unlink_anon_vmas() and eventually underflow when exiting as a result of another call to unlink_anon_vmas(). That's how "kernel BUG at mm/rmap.c:399!" is triggered for me. This patch fixes the underflow by dropping dst->anon_vma when allocation fails. It's safe to do so regardless of original value of dst->anon_vma because dst->anon_vma doesn't have valid meaning if anon_vma_clone() fails. Besides, callers don't care dst->anon_vma in such case neither. Also suggested by Michal Hocko, we can clean up vma_adjust() a bit as anon_vma_clone() now does the work. [ tweak comment] Fixes: 7a3ef208e662 ("mm: prevent endless growth of anon_vma hierarchy") Signed-off-by: Leon Yu <> Signed-off-by: Konstantin Khlebnikov <> Reviewed-by: Michal Hocko <> Acked-by: Rik van Riel <> Acked-by: David Rientjes <> Cc: <> Signed-off-by: Andrew Morton <> Signed-off-by: Linus Torvalds <>
Diffstat (limited to 'mm/pagewalk.c')
0 files changed, 0 insertions, 0 deletions