kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
linux/mm
History
Mike Kravetz 766c7aa328 mm/hugetlb.c: fix reservation race when freeing surplus pages 
commit e5bbc8a6c9 upstream.

return_unused_surplus_pages() decrements the global reservation count,
and frees any unused surplus pages that were backing the reservation.

Commit 7848a4bf51 ("mm/hugetlb.c: add cond_resched_lock() in
return_unused_surplus_pages()") added a call to cond_resched_lock in the
loop freeing the pages.

As a result, the hugetlb_lock could be dropped, and someone else could
use the pages that will be freed in subsequent iterations of the loop.
This could result in inconsistent global hugetlb page state, application
api failures (such as mmap) failures or application crashes.

When dropping the lock in return_unused_surplus_pages, make sure that
the global reservation count (resv_huge_pages) remains sufficiently
large to prevent someone else from claiming pages about to be freed.

Analyzed by Paul Cassella.

Fixes: 7848a4bf51 ("mm/hugetlb.c: add cond_resched_lock() in return_unused_surplus_pages()")
Link: http://lkml.kernel.org/r/1483991767-6879-1-git-send-email-mike.kravetz@oracle.com
Signed-off-by: Mike Kravetz <mike.kravetz@oracle.com>
Reported-by: Paul Cassella <cassella@cray.com>
Suggested-by: Michal Hocko <mhocko@kernel.org>
Cc: Masayoshi Mizuma <m.mizuma@jp.fujitsu.com>
Cc: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
Cc: Aneesh Kumar <aneesh.kumar@linux.vnet.ibm.com>
Cc: Hillf Danton <hillf.zj@alibaba-inc.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
History 2017-03-16 02:26:56 +00:00
..
backing-dev.c block: fix bdi vs gendisk lifetime mismatch 2016-11-20 01:17:05 +00:00
balloon_compaction.c mm/balloon_compaction: fix deflation when compaction is disabled 2016-06-15 21:29:35 +01:00
bootmem.c mem-hotplug: reset node managed pages when hot-adding a new pgdat 2014-11-27 11:21:50 +00:00
cleancache.c mm: dump page when hitting a VM_BUG_ON using VM_BUG_ON_PAGE 2014-01-23 16:36:50 -08:00
compaction.c mm/balloon_compaction: redesign ballooned pages management 2016-06-15 21:29:35 +01:00
debug-pagealloc.c mm, x86: Remove debug_pagealloc_enabled 2011-12-06 09:24:07 +01:00
dmapool.c Fix unbalanced mutex in dma_pool_create(). 2014-10-05 13:41:09 -07:00
early_ioremap.c mm: create generic early_ioremap() support 2014-04-07 16:36:15 -07:00
fadvise.c teach SYSCALL_DEFINE<n> how to deal with long long/unsigned long long 2013-03-03 22:46:22 -05:00
failslab.c switch debugfs to umode_t 2012-01-03 22:54:56 -05:00
filemap.c vfs,mm: fix return value of read() at s_maxbytes 2017-02-23 03:54:48 +00:00
filemap_xip.c seqcount: Add lockdep functionality to seqcount/seqlock structures 2013-11-06 12:40:26 +01:00
fremap.c mm: mark remap_file_pages() syscall as deprecated 2014-06-06 16:08:17 -07:00
frontswap.c mm: frontswap: invalidate expired data on a dup-store failure 2014-12-10 17:49:41 +00:00
gup.c mm: remove gup_flags FOLL_WRITE games from __get_user_pages() 2016-10-20 23:41:12 +01:00
highmem.c Some nice cleanups, and even a patch my wife did as a "live" demo for 2012-12-20 08:37:05 -08:00
huge_memory.c mm/huge_memory: replace VM_NO_THP VM_BUG_ON with actual VMA check 2016-06-15 21:29:28 +01:00
hugetlb.c mm/hugetlb.c: fix reservation race when freeing surplus pages 2017-03-16 02:26:56 +00:00
hugetlb_cgroup.c cgroup: remove css_parent() 2014-05-16 13:22:48 -04:00
hwpoison-inject.c mm/hwpoison: add '#' to hwpoison_inject 2014-01-21 16:19:48 -08:00
init-mm.c atomic: use <linux/atomic.h> 2011-07-26 16:49:47 -07:00
internal.h mm, compaction: properly signal and act upon lock and need_sched() contention 2014-06-04 16:54:11 -07:00
interval_tree.c mm: add CONFIG_DEBUG_VM_RB build option 2012-10-09 16:22:42 +09:00
iov_iter.c Fix thinko in iov_iter_single_seg_count 2014-11-27 11:21:48 +00:00
Kconfig mm/zsmalloc: make zsmalloc module-buildable 2014-06-04 16:54:14 -07:00
Kconfig.debug mm: more intensive memory corruption debugging 2012-01-10 16:30:42 -08:00
kmemcheck.c kmemcheck: Fix build errors due to missing slab.h 2010-03-30 22:02:32 +09:00
kmemleak-test.c mm/kmemleak-test.c: use pr_fmt for logging 2014-06-06 16:08:18 -07:00
kmemleak.c mm: kmemleak: allow safe memory scanning during kmemleak disabling 2015-07-15 10:00:54 +01:00
ksm.c mm,ksm: fix endless looping in allocating memory when ksm enable 2016-11-20 01:17:35 +00:00
list_lru.c mm: keep page cache radix tree nodes in check 2014-04-03 16:21:01 -07:00
maccess.c mm: Map most files to use export.h instead of module.h 2011-10-31 09:20:12 -04:00
madvise.c mm: madvise: fix MADV_WILLNEED on shmem swapouts 2014-05-23 09:37:29 -07:00
Makefile mm: move get_user_pages()-related code to separate file 2014-06-04 16:54:04 -07:00
memblock.c memblock, memhotplug: fix wrong type in memblock_find_in_range_node(). 2014-10-05 13:41:03 -07:00
memcontrol.c memcg: only free spare array when readers are done 2016-02-02 19:09:49 +00:00
memory-failure.c mm: soft-offline: check return value in second __get_any_page() call 2016-02-02 19:09:48 +00:00
memory.c mm: avoid setting up anonymous pages into file mapping 2015-08-11 09:57:27 +01:00
memory_hotplug.c mm/hugetlb: check for reserved hugepages during memory offline 2017-02-23 03:54:10 +00:00
mempolicy.c mm, numa: really disable NUMA balancing by default on single node machines 2015-05-28 10:00:03 +01:00
mempool.c mm/mempool.c: update the kmemleak stack trace for mempool allocations 2014-06-06 16:08:17 -07:00
migrate.c mm: Export migrate_page_move_mapping and migrate_page_copy 2016-08-22 22:38:18 +01:00
mincore.c mm + fs: prepare for non-page entries in page cache radix trees 2014-04-03 16:21:00 -07:00
mlock.c mm: try_to_unmap_cluster() should lock_page() before mlocking 2014-04-07 16:35:57 -07:00
mm_init.c mm: bring back /sys/kernel/mm 2014-01-27 21:02:39 -08:00
mmap.c mm: replace vma_lock_anon_vma with anon_vma_lock_read/write 2016-02-25 10:34:44 +00:00
mmu_context.c sched/mm: call finish_arch_post_lock_switch in idle_task_exit and use_mm 2014-02-21 08:50:17 +01:00
mmu_notifier.c mm: audit/fix non-modular users of module_init in core code 2014-01-23 16:36:52 -08:00
mmzone.c mm: numa: Change page last {nid,pid} into {cpu,pid} 2013-10-09 14:47:45 +02:00
mprotect.c mm: move mmu notifier call from change_protection to change_pmd_range 2014-04-07 16:35:50 -07:00
mremap.c mm, thp: close race between mremap() and split_huge_page() 2014-05-11 17:55:48 +09:00
msync.c msync: fix incorrect fstart calculation 2014-07-03 09:21:53 -07:00
nobootmem.c mem-hotplug: reset node managed pages when hot-adding a new pgdat 2014-11-27 11:21:50 +00:00
nommu.c mm/nommu.c: fix arithmetic overflow in __vm_enough_memory() 2015-03-02 13:17:17 +00:00
oom_kill.c OOM, PM: OOM killed task shouldn't escape PM suspend 2014-11-05 11:43:09 +00:00
page-writeback.c writeback: use |1 instead of +1 to protect against div by zero 2015-05-20 13:25:57 +01:00
page_alloc.c mm: when stealing freepages, also take pages created by splitting buddy page 2015-03-02 13:17:16 +00:00
page_cgroup.c cgroup/kmemleak: add kmemleak_free() for cgroup deallocations. 2014-11-13 11:48:55 +00:00
page_io.c fix __swap_writepage() compile failure on old gcc versions 2014-06-14 19:30:48 -05:00
page_isolation.c mm: fix invalid node in alloc_migrate_target() 2016-05-01 00:06:08 +02:00
pagewalk.c mm: pagewalk: call pte_hole() for VM_PFNMAP during walk_page_range 2015-02-10 13:38:47 +00:00
percpu-km.c percpu: clear memory allocated with the km allocator 2010-10-02 10:28:42 +03:00
percpu-vm.c percpu: perform tlb flush after pcpu_map_pages() failure 2014-10-05 13:41:06 -07:00
percpu.c Revert "percpu: free percpu allocation info for uniprocessor system" 2014-11-14 15:20:06 +00:00
pgtable-generic.c mm: fix TLB flush race between migration, and change_protection_range 2013-12-18 19:04:51 -08:00
process_vm_access.c start adding the tag to iov_iter 2014-05-06 17:32:49 -04:00
quicklist.c mm: delete various needless include <linux/module.h> 2011-10-31 09:20:11 -04:00
readahead.c mm/readahead.c: inline ra_submit 2014-04-07 16:35:58 -07:00
rmap.c mm: fix anon_vma->degree underflow in anon_vma endless growing prevention 2015-04-10 10:04:05 +01:00
shmem.c fs: Give dentry to inode_change_ok() instead of inode 2017-02-23 03:53:52 +00:00
slab.c mm: slab: only move management objects off-slab for sizes larger than KMALLOC_MIN_SIZE 2015-12-13 17:49:11 +00:00
slab.h memcg, slab: merge memcg_{bind,release}_pages to memcg_{un}charge_slab 2014-06-04 16:54:01 -07:00
slab_common.c Merge branch 'slab/urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/penberg/linux into for-3.16-rcX 2014-07-22 18:38:27 -04:00
slob.c slab: get_online_mems for kmem_cache_{create,destroy,shrink} 2014-06-04 16:53:59 -07:00
slub.c slub: fix off by one in number of slab tests 2014-07-03 09:21:53 -07:00
sparse-vmemmap.c mm/sparse: use memblock apis for early memory allocations 2014-01-21 16:19:47 -08:00
sparse.c mm: use macros from compiler.h instead of __attribute__((...)) 2014-04-07 16:35:54 -07:00
swap.c mm: non-atomically mark page accessed during page cache allocation where possible 2014-06-04 16:54:10 -07:00
swap_state.c mm: page_alloc: convert hot/cold parameter and immediate callers to bool 2014-06-04 16:54:09 -07:00
swapfile.c swapfile: fix memory corruption via malformed swapfile 2017-02-23 03:54:32 +00:00
truncate.c mm: Remove false WARN_ON from pagecache_isize_extended() 2014-11-13 11:49:03 +00:00
util.c vm_is_stack: use for_each_thread() rather then buggy while_each_thread() 2014-09-05 16:36:43 -07:00
vmacache.c mm,vmacache: optimize overflow system-wide flushing 2014-06-04 16:53:57 -07:00
vmalloc.c mm/vmalloc.c: export unmap_kernel_range() 2014-06-04 16:54:14 -07:00
vmpressure.c mm/vmpressure.c: fix race in vmpressure_work_fn() 2014-12-10 17:49:42 +00:00
vmscan.c vmscan: fix increasing nr_isolated incurred by putback unevictable pages 2015-09-29 16:44:51 +01:00
vmstat.c vmstat: explicitly schedule per-cpu work on the CPU we need it to run on 2016-02-24 10:26:37 +00:00
workingset.c mm: workingset: fix crash in shadow node shrinker caused by replace_page_cache_page() 2016-11-20 01:17:36 +00:00
zbud.c mm/zbud.c: make size unsigned like unique callsite 2014-06-04 16:54:13 -07:00
zsmalloc.c zsmalloc: fixup trivial zs size classes value in comments 2014-06-04 16:54:13 -07:00
zswap.c mm/zswap: NUMA aware allocation for zswap_dstmem 2014-06-04 16:54:14 -07:00