diff options
author | Hugh Dickins <hugh.dickins@tiscali.co.uk> | 2009-08-24 11:30:28 -0400 |
---|---|---|
committer | Linus Torvalds <torvalds@linux-foundation.org> | 2009-08-24 15:53:01 -0400 |
commit | 353d5c30c666580347515da609dd74a2b8e9b828 (patch) | |
tree | 03cf3b5c0bc2ce08a12af303b141503ad833178f /fs/hugetlbfs/inode.c | |
parent | 0257a0c0c1997aac28420e784b3ef8f3ce17f093 (diff) |
mm: fix hugetlb bug due to user_shm_unlock call
2.6.30's commit 8a0bdec194c21c8fdef840989d0d7b742bb5d4bc removed
user_shm_lock() calls in hugetlb_file_setup() but left the
user_shm_unlock call in shm_destroy().
In detail:
Assume that can_do_hugetlb_shm() returns true and hence user_shm_lock()
is not called in hugetlb_file_setup(). However, user_shm_unlock() is
called in any case in shm_destroy() and in the following
atomic_dec_and_lock(&up->__count) in free_uid() is executed and if
up->__count gets zero, also cleanup_user_struct() is scheduled.
Note that sched_destroy_user() is empty if CONFIG_USER_SCHED is not set.
However, the ref counter up->__count gets unexpectedly non-positive and
the corresponding structs are freed even though there are live
references to them, resulting in a kernel oops after a lots of
shmget(SHM_HUGETLB)/shmctl(IPC_RMID) cycles and CONFIG_USER_SCHED set.
Hugh changed Stefan's suggested patch: can_do_hugetlb_shm() at the
time of shm_destroy() may give a different answer from at the time
of hugetlb_file_setup(). And fixed newseg()'s no_id error path,
which has missed user_shm_unlock() ever since it came in 2.6.9.
Reported-by: Stefan Huber <shuber2@gmail.com>
Signed-off-by: Hugh Dickins <hugh.dickins@tiscali.co.uk>
Tested-by: Stefan Huber <shuber2@gmail.com>
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'fs/hugetlbfs/inode.c')
-rw-r--r-- | fs/hugetlbfs/inode.c | 20 |
1 files changed, 12 insertions, 8 deletions
diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c index 941c8425c10b..cb88dac8ccaa 100644 --- a/fs/hugetlbfs/inode.c +++ b/fs/hugetlbfs/inode.c | |||
@@ -935,26 +935,28 @@ static int can_do_hugetlb_shm(void) | |||
935 | return capable(CAP_IPC_LOCK) || in_group_p(sysctl_hugetlb_shm_group); | 935 | return capable(CAP_IPC_LOCK) || in_group_p(sysctl_hugetlb_shm_group); |
936 | } | 936 | } |
937 | 937 | ||
938 | struct file *hugetlb_file_setup(const char *name, size_t size, int acctflag) | 938 | struct file *hugetlb_file_setup(const char *name, size_t size, int acctflag, |
939 | struct user_struct **user) | ||
939 | { | 940 | { |
940 | int error = -ENOMEM; | 941 | int error = -ENOMEM; |
941 | int unlock_shm = 0; | ||
942 | struct file *file; | 942 | struct file *file; |
943 | struct inode *inode; | 943 | struct inode *inode; |
944 | struct dentry *dentry, *root; | 944 | struct dentry *dentry, *root; |
945 | struct qstr quick_string; | 945 | struct qstr quick_string; |
946 | struct user_struct *user = current_user(); | ||
947 | 946 | ||
947 | *user = NULL; | ||
948 | if (!hugetlbfs_vfsmount) | 948 | if (!hugetlbfs_vfsmount) |
949 | return ERR_PTR(-ENOENT); | 949 | return ERR_PTR(-ENOENT); |
950 | 950 | ||
951 | if (!can_do_hugetlb_shm()) { | 951 | if (!can_do_hugetlb_shm()) { |
952 | if (user_shm_lock(size, user)) { | 952 | *user = current_user(); |
953 | unlock_shm = 1; | 953 | if (user_shm_lock(size, *user)) { |
954 | WARN_ONCE(1, | 954 | WARN_ONCE(1, |
955 | "Using mlock ulimits for SHM_HUGETLB deprecated\n"); | 955 | "Using mlock ulimits for SHM_HUGETLB deprecated\n"); |
956 | } else | 956 | } else { |
957 | *user = NULL; | ||
957 | return ERR_PTR(-EPERM); | 958 | return ERR_PTR(-EPERM); |
959 | } | ||
958 | } | 960 | } |
959 | 961 | ||
960 | root = hugetlbfs_vfsmount->mnt_root; | 962 | root = hugetlbfs_vfsmount->mnt_root; |
@@ -996,8 +998,10 @@ out_inode: | |||
996 | out_dentry: | 998 | out_dentry: |
997 | dput(dentry); | 999 | dput(dentry); |
998 | out_shm_unlock: | 1000 | out_shm_unlock: |
999 | if (unlock_shm) | 1001 | if (*user) { |
1000 | user_shm_unlock(size, user); | 1002 | user_shm_unlock(size, *user); |
1003 | *user = NULL; | ||
1004 | } | ||
1001 | return ERR_PTR(error); | 1005 | return ERR_PTR(error); |
1002 | } | 1006 | } |
1003 | 1007 | ||