| From e73b7fffe487c315fd1a4fa22282e3362b440a06 Mon Sep 17 00:00:00 2001 |
| From: Martin Schwidefsky <schwidefsky@de.ibm.com> |
| Date: Sun, 30 Oct 2011 15:16:08 +0100 |
| Subject: [S390] memory leak with RCU_TABLE_FREE |
| |
| From: Martin Schwidefsky <schwidefsky@de.ibm.com> |
| |
| commit e73b7fffe487c315fd1a4fa22282e3362b440a06 upstream. |
| |
| The rcu page table free code uses a couple of bits in the page table |
| pointer passed to tlb_remove_table to discern the different page table |
| types. __tlb_remove_table extracts the type with an incorrect mask which |
| leads to memory leaks. The correct mask is ((FRAG_MASK << 4) | FRAG_MASK). |
| |
| Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> |
| |
| --- |
| arch/s390/mm/pgtable.c | 5 +++-- |
| 1 file changed, 3 insertions(+), 2 deletions(-) |
| |
| --- a/arch/s390/mm/pgtable.c |
| +++ b/arch/s390/mm/pgtable.c |
| @@ -662,8 +662,9 @@ void page_table_free_rcu(struct mmu_gath |
| |
| void __tlb_remove_table(void *_table) |
| { |
| - void *table = (void *)((unsigned long) _table & PAGE_MASK); |
| - unsigned type = (unsigned long) _table & ~PAGE_MASK; |
| + const unsigned long mask = (FRAG_MASK << 4) | FRAG_MASK; |
| + void *table = (void *)((unsigned long) _table & ~mask); |
| + unsigned type = (unsigned long) _table & mask; |
| |
| if (type) |
| __page_table_free_rcu(table, type); |
