DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 40D1B2192C
Received-SPF: pass (google.com: domain of rcampbell@nvidia.com designates 216.228.121.65 as permitted sender) client-ip=216.228.121.65;
From: <rcampbell@nvidia.com>
To: <linux-mm@kvack.org>
CC: Ralph Campbell <rcampbell@nvidia.com>, Andrew Morton
	<akpm@linux-foundation.org>, =?UTF-8?q?J=C3=A9r=C3=B4me=20Glisse?=
	<jglisse@redhat.com>, John Hubbard <jhubbard@nvidia.com>
Subject: [PATCH] mm/hmm: Fix struct hmm memory leak
Date: Fri, 15 Feb 2019 13:59:22 -0800
Message-ID: <20190215215922.29797-1-rcampbell@nvidia.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Sender: owner-linux-mm@kvack.org
Precedence: bulk

From: Ralph Campbell <rcampbell@nvidia.com>

The patch [1] introduced reference counting on struct hmm and works
fine when calling hmm_mirror_register() and hmm_mirror_unregister().
However, when a process exits without explicitly unregistering,
the MMU notifier callback hmm_release() doesn't release the mirror->hmm
reference and thus leaks the struct hmm allocation.
Fix this by releasing the reference in hmm_release().

[1] https://marc.info/?l=3Dlinux-mm&m=3D154878089214597&w=3D2
    ("mm/hmm: use reference counting for HMM struct")

Signed-off-by: Ralph Campbell <rcampbell@nvidia.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: "J=C3=A9r=C3=B4me Glisse" <jglisse@redhat.com>
Cc: John Hubbard <jhubbard@nvidia.com>
---
 mm/hmm.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/mm/hmm.c b/mm/hmm.c
index 3c9781037918..50523df6ea0c 100644
--- a/mm/hmm.c
+++ b/mm/hmm.c
@@ -179,6 +179,8 @@ static void hmm_release(struct mmu_notifier *mn, struct=
 mm_struct *mm)
 			mirror->ops->release(mirror);
 			down_write(&hmm->mirrors_sem);
 		}
+		hmm_put(mirror->hmm);
+		mirror->hmm =3D NULL;
 		mirror =3D list_first_entry_or_null(&hmm->mirrors,
 						  struct hmm_mirror, list);
 	}
--=20
2.17.2