Andrew Morton noticed that the error return from anon_vma_clone() was being dropped and replaced with -ENOMEM (which is not itself a bug because the only error return value from anon_vma_clone() is -ENOMEM). I did an audit of callers of anon_vma_clone() and discovered an actual bug where the error return was being lost. In __split_vma(), between Linux 3.11 and 3.12 the code was changed so the err variable is used before the call to anon_vma_clone() and the default initial value of -ENOMEM is overwritten. So a failure of anon_vma_clone() will return success since err at this point is now zero. Below is a patch which fixes this bug and also propagates the error return value from anon_vma_clone() in all cases.
Unified · Split
| @@ -776,8 +776,11 @@ again: remove_next = 1 + (end > next->vm_end); · 775 unmodified lines | |||
| 776 | * shrinking vma had, to cover any anon pages imported. | 776 | * shrinking vma had, to cover any anon pages imported. |
| 777 | */ | 777 | */ |
| 778 | if (exporter && exporter->anon_vma && !importer->anon_vma) { | 778 | if (exporter && exporter->anon_vma && !importer->anon_vma) { |
| 779 | if (anon_vma_clone(importer, exporter)) | 779 | int error; |
| 780 | return -ENOMEM; | 780 | |
| 781 | error = anon_vma_clone(importer, exporter); | ||
| 782 | if (error) | ||
| 783 | return error; | ||
| 781 | importer->anon_vma = exporter->anon_vma; | 784 | importer->anon_vma = exporter->anon_vma; |
| 782 | } | 785 | } |
| 783 | } | 786 | } |
| @@ -2469,7 +2472,8 @@ static int __split_vma(struct mm_struct *mm, struct vm_area_struct *vma, · 1685 unmodified lines | |||
| 2469 | if (err) | 2472 | if (err) |
| 2470 | goto out_free_vma; | 2473 | goto out_free_vma; |
| 2471 | 2474 | ||
| 2472 | if (anon_vma_clone(new, vma)) | 2475 | err = anon_vma_clone(new, vma); |
| 2476 | if (err) | ||
| 2473 | goto out_free_mpol; | 2477 | goto out_free_mpol; |
| 2474 | 2478 | ||
| 2475 | if (new->vm_file) | 2479 | if (new->vm_file) |
| @@ -274,6 +274,7 @@ int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma) · 273 unmodified lines | |||
| 274 | { | 274 | { |
| 275 | struct anon_vma_chain *avc; | 275 | struct anon_vma_chain *avc; |
| 276 | struct anon_vma *anon_vma; | 276 | struct anon_vma *anon_vma; |
| 277 | int error; | ||
| 277 | 278 | ||
| 278 | /* Don't bother if the parent process has no anon_vma here. */ | 279 | /* Don't bother if the parent process has no anon_vma here. */ |
| 279 | if (!pvma->anon_vma) | 280 | if (!pvma->anon_vma) |
| @@ -283,8 +284,9 @@ int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma) · 3 unmodified lines | |||
| 283 | * First, attach the new VMA to the parent VMA's anon_vmas, | 284 | * First, attach the new VMA to the parent VMA's anon_vmas, |
| 284 | * so rmap can find non-COWed pages in child processes. | 285 | * so rmap can find non-COWed pages in child processes. |
| 285 | */ | 286 | */ |
| 286 | if (anon_vma_clone(vma, pvma)) | 287 | error = anon_vma_clone(vma, pvma); |
| 287 | return -ENOMEM; | 288 | if (error) |
| 289 | return error; | ||
| 288 | 290 | ||
| 289 | /* Then add our own anon_vma. */ | 291 | /* Then add our own anon_vma. */ |
| 290 | anon_vma = anon_vma_alloc(); | 292 | anon_vma = anon_vma_alloc(); |