From 2386894043fc3be2c0d2d25edb8c741f18c592ec Mon Sep 17 00:00:00 2001 From: Andrew Morton Date: Mon, 12 Apr 2004 01:03:03 -0700 Subject: [PATCH] [PATCH] do_fork() error path memory leak From: In do_fork(), if an error occurs after the mm_struct for the child has been allocated, it is never freed. The exit_mm() meant to free it increments the mm_count and this count is never decremented. (For a running process that is exitting, schedule() takes care this; however, the child process being cleaned up is not running.) In the CLONE_VM case, the parent's mm_struct will get an extra mm_count and so it will never be freed. This patch should fix both the CLONE_VM and the not CLONE_VM case; the test of p->active_mm prevents a panic in the case that a kernel-thread is being cloned. --- kernel/fork.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/kernel/fork.c b/kernel/fork.c index b4cbfd04847bd..4f5b018777d89 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -1086,6 +1086,8 @@ bad_fork_cleanup_namespace: exit_namespace(p); bad_fork_cleanup_mm: exit_mm(p); + if (p->active_mm) + mmdrop(p->active_mm); bad_fork_cleanup_signal: exit_signal(p); bad_fork_cleanup_sighand: -- 2.53.0