aboutsummaryrefslogtreecommitdiffstats
path: root/include
diff options
context:
space:
mode:
authorHugh Dickins <hugh.dickins@tiscali.co.uk>2009-08-24 11:30:28 -0400
committerLinus Torvalds <torvalds@linux-foundation.org>2009-08-24 15:53:01 -0400
commit353d5c30c666580347515da609dd74a2b8e9b828 (patch)
tree03cf3b5c0bc2ce08a12af303b141503ad833178f /include
parent0257a0c0c1997aac28420e784b3ef8f3ce17f093 (diff)
mm: fix hugetlb bug due to user_shm_unlock call
2.6.30's commit 8a0bdec194c21c8fdef840989d0d7b742bb5d4bc removed user_shm_lock() calls in hugetlb_file_setup() but left the user_shm_unlock call in shm_destroy(). In detail: Assume that can_do_hugetlb_shm() returns true and hence user_shm_lock() is not called in hugetlb_file_setup(). However, user_shm_unlock() is called in any case in shm_destroy() and in the following atomic_dec_and_lock(&up->__count) in free_uid() is executed and if up->__count gets zero, also cleanup_user_struct() is scheduled. Note that sched_destroy_user() is empty if CONFIG_USER_SCHED is not set. However, the ref counter up->__count gets unexpectedly non-positive and the corresponding structs are freed even though there are live references to them, resulting in a kernel oops after a lots of shmget(SHM_HUGETLB)/shmctl(IPC_RMID) cycles and CONFIG_USER_SCHED set. Hugh changed Stefan's suggested patch: can_do_hugetlb_shm() at the time of shm_destroy() may give a different answer from at the time of hugetlb_file_setup(). And fixed newseg()'s no_id error path, which has missed user_shm_unlock() ever since it came in 2.6.9. Reported-by: Stefan Huber <shuber2@gmail.com> Signed-off-by: Hugh Dickins <hugh.dickins@tiscali.co.uk> Tested-by: Stefan Huber <shuber2@gmail.com> Cc: stable@kernel.org Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'include')
-rw-r--r--include/linux/hugetlb.h6
1 files changed, 4 insertions, 2 deletions
diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h
index 2723513a5651..5cbc620bdfe0 100644
--- a/include/linux/hugetlb.h
+++ b/include/linux/hugetlb.h
@@ -10,6 +10,7 @@
10#include <asm/tlbflush.h> 10#include <asm/tlbflush.h>
11 11
12struct ctl_table; 12struct ctl_table;
13struct user_struct;
13 14
14int PageHuge(struct page *page); 15int PageHuge(struct page *page);
15 16
@@ -146,7 +147,8 @@ static inline struct hugetlbfs_sb_info *HUGETLBFS_SB(struct super_block *sb)
146 147
147extern const struct file_operations hugetlbfs_file_operations; 148extern const struct file_operations hugetlbfs_file_operations;
148extern struct vm_operations_struct hugetlb_vm_ops; 149extern struct vm_operations_struct hugetlb_vm_ops;
149struct file *hugetlb_file_setup(const char *name, size_t, int); 150struct file *hugetlb_file_setup(const char *name, size_t size, int acct,
151 struct user_struct **user);
150int hugetlb_get_quota(struct address_space *mapping, long delta); 152int hugetlb_get_quota(struct address_space *mapping, long delta);
151void hugetlb_put_quota(struct address_space *mapping, long delta); 153void hugetlb_put_quota(struct address_space *mapping, long delta);
152 154
@@ -168,7 +170,7 @@ static inline void set_file_hugepages(struct file *file)
168 170
169#define is_file_hugepages(file) 0 171#define is_file_hugepages(file) 0
170#define set_file_hugepages(file) BUG() 172#define set_file_hugepages(file) BUG()
171#define hugetlb_file_setup(name,size,acctflag) ERR_PTR(-ENOSYS) 173#define hugetlb_file_setup(name,size,acct,user) ERR_PTR(-ENOSYS)
172 174
173#endif /* !CONFIG_HUGETLBFS */ 175#endif /* !CONFIG_HUGETLBFS */
174 176