From: Suren Baghdasaryan Date: Thu, 5 Jan 2023 00:02:40 +0000 (-0800) Subject: mm: fix vma->anon_name memory leak for anonymous shmem VMAs X-Git-Tag: v6.6.17~5579^2~59 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=a1193de562f54c7c9f60ca9f2db96e50a7608de1;p=platform%2Fkernel%2Flinux-rpi.git mm: fix vma->anon_name memory leak for anonymous shmem VMAs free_anon_vma_name() is missing a check for anonymous shmem VMA which leads to a memory leak due to refcount not being dropped. Fix this by calling anon_vma_name_put() unconditionally. It will free vma->anon_name whenever it's non-NULL. Link: https://lkml.kernel.org/r/20230105000241.1450843-1-surenb@google.com Fixes: d09e8ca6cb93 ("mm: anonymous shared memory naming") Signed-off-by: Suren Baghdasaryan Suggested-by: David Hildenbrand Reviewed-by: David Hildenbrand Reported-by: syzbot+91edf9178386a07d06a7@syzkaller.appspotmail.com Cc: Hugh Dickins Cc: Pasha Tatashin Signed-off-by: Andrew Morton --- diff --git a/include/linux/mm_inline.h b/include/linux/mm_inline.h index e8ed225..ff3f3f2 100644 --- a/include/linux/mm_inline.h +++ b/include/linux/mm_inline.h @@ -413,8 +413,7 @@ static inline void free_anon_vma_name(struct vm_area_struct *vma) * Not using anon_vma_name because it generates a warning if mmap_lock * is not held, which might be the case here. */ - if (!vma->vm_file) - anon_vma_name_put(vma->anon_name); + anon_vma_name_put(vma->anon_name); } static inline bool anon_vma_name_eq(struct anon_vma_name *anon_name1,