hugetlbfs: always use address space in inode for resv_map pointer

Continuing discussion about 58b6e5e8f1ad ("hugetlbfs: fix memory leak for
resv_map") brought up the issue that inode->i_mapping may not point to the
address space embedded within the inode at inode eviction time.  The
hugetlbfs truncate routine handles this by explicitly using inode->i_data.
However, code cleaning up the resv_map will still use the address space
pointed to by inode->i_mapping.  Luckily, private_data is NULL for address
spaces in all such cases today but, there is no guarantee this will
continue.

Change all hugetlbfs code getting a resv_map pointer to explicitly get it
from the address space embedded within the inode.  In addition, add more
comments in the code to indicate why this is being done.

Link: http://lkml.kernel.org/r/20190419204435.16984-1-mike.kravetz@oracle.com
Signed-off-by: Mike Kravetz <mike.kravetz@oracle.com>
Reported-by: Yufen Yu <yuyufen@huawei.com>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
Cc: "Kirill A . Shutemov" <kirill.shutemov@linux.intel.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

1 files changed, 9 insertions, 2 deletions

diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
index f23237135163..1dcc57189382 100644
--- a/fs/hugetlbfs/inode.c
+++ b/fs/hugetlbfs/inode.c
@@ -497,8 +497,15 @@ static void hugetlbfs_evict_inode(struct inode *inode)
         struct resv_map *resv_map;
 
         remove_inode_hugepages(inode, 0, LLONG_MAX);
-        resv_map = (struct resv_map *)inode->i_mapping->private_data;
-        /* root inode doesn't have the resv_map, so we should check it */
+
+        /*
+         * Get the resv_map from the address space embedded in the inode.
+         * This is the address space which points to any resv_map allocated
+         * at inode creation time.  If this is a device special inode,
+         * i_mapping may not point to the original address space.
+         */
+        resv_map = (struct resv_map *)(&inode->i_data)->private_data;
+        /* Only regular and link inodes have associated reserve maps */
         if (resv_map)
                 resv_map_release(&resv_map->refs);
         clear_inode(inode);