Commit 8c7b49b3 authored by Al Viro's avatar Al Viro

fix a struct file leak in do_mmap_pgoff()

Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
parent f8b72560
...@@ -948,24 +948,6 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr, ...@@ -948,24 +948,6 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
if (mm->map_count > sysctl_max_map_count) if (mm->map_count > sysctl_max_map_count)
return -ENOMEM; return -ENOMEM;
if (flags & MAP_HUGETLB) {
struct user_struct *user = NULL;
if (file)
return -EINVAL;
/*
* VM_NORESERVE is used because the reservations will be
* taken when vm_ops->mmap() is called
* A dummy user value is used because we are not locking
* memory so no accounting is necessary
*/
len = ALIGN(len, huge_page_size(&default_hstate));
file = hugetlb_file_setup(HUGETLB_ANON_FILE, len, VM_NORESERVE,
&user, HUGETLB_ANONHUGE_INODE);
if (IS_ERR(file))
return PTR_ERR(file);
}
/* Obtain the address to map to. we verify (or select) it and ensure /* Obtain the address to map to. we verify (or select) it and ensure
* that it represents a valid section of the address space. * that it represents a valid section of the address space.
*/ */
......
...@@ -280,9 +280,24 @@ SYSCALL_DEFINE6(mmap_pgoff, unsigned long, addr, unsigned long, len, ...@@ -280,9 +280,24 @@ SYSCALL_DEFINE6(mmap_pgoff, unsigned long, addr, unsigned long, len,
unsigned long retval = -EBADF; unsigned long retval = -EBADF;
if (!(flags & MAP_ANONYMOUS)) { if (!(flags & MAP_ANONYMOUS)) {
if (unlikely(flags & MAP_HUGETLB))
return -EINVAL;
file = fget(fd); file = fget(fd);
if (!file) if (!file)
goto out; goto out;
} else if (flags & MAP_HUGETLB) {
struct user_struct *user = NULL;
/*
* VM_NORESERVE is used because the reservations will be
* taken when vm_ops->mmap() is called
* A dummy user value is used because we are not locking
* memory so no accounting is necessary
*/
len = ALIGN(len, huge_page_size(&default_hstate));
file = hugetlb_file_setup(HUGETLB_ANON_FILE, len, VM_NORESERVE,
&user, HUGETLB_ANONHUGE_INODE);
if (IS_ERR(file))
return PTR_ERR(file);
} }
flags &= ~(MAP_EXECUTABLE | MAP_DENYWRITE); flags &= ~(MAP_EXECUTABLE | MAP_DENYWRITE);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment