Mike Kravetz e5bbc8a6c9 mm/hugetlb.c: fix reservation race when freeing surplus pages ... return_unused_surplus_pages() decrements the global reservation count, and frees any unused surplus pages that were backing the reservation. Commit 7848a4bf51 ("mm/hugetlb.c: add cond_resched_lock() in return_unused_surplus_pages()") added a call to cond_resched_lock in the loop freeing the pages. As a result, the hugetlb_lock could be dropped, and someone else could use the pages that will be freed in subsequent iterations of the loop. This could result in inconsistent global hugetlb page state, application api failures (such as mmap) failures or application crashes. When dropping the lock in return_unused_surplus_pages, make sure that the global reservation count (resv_huge_pages) remains sufficiently large to prevent someone else from claiming pages about to be freed. Analyzed by Paul Cassella. Fixes: 7848a4bf51 ("mm/hugetlb.c: add cond_resched_lock() in return_unused_surplus_pages()") Link: http://lkml.kernel.org/r/1483991767-6879-1-git-send-email-mike.kravetz@oracle.com Signed-off-by: Mike Kravetz <mike.kravetz@oracle.com> Reported-by: Paul Cassella <cassella@cray.com> Suggested-by: Michal Hocko <mhocko@kernel.org> Cc: Masayoshi Mizuma <m.mizuma@jp.fujitsu.com> Cc: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com> Cc: Aneesh Kumar <aneesh.kumar@linux.vnet.ibm.com> Cc: Hillf Danton <hillf.zj@alibaba-inc.com> Cc: <stable@vger.kernel.org> [3.15+] Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>		2017-01-10 18:31:55 -08:00
..
kasan
backing-dev.c
balloon_compaction.c
bootmem.c
cleancache.c
cma_debug.c
cma.c
cma.h
compaction.c
debug_page_ref.c
debug.c
dmapool.c
early_ioremap.c
fadvise.c
failslab.c
filemap.c	dax: fix deadlock with DAX 4k holes	2017-01-10 18:31:54 -08:00
frame_vector.c
frontswap.c
gup.c
highmem.c
huge_memory.c	mm: pmd dirty emulation in page fault handler	2017-01-10 18:31:55 -08:00
hugetlb_cgroup.c
hugetlb.c	mm/hugetlb.c: fix reservation race when freeing surplus pages	2017-01-10 18:31:55 -08:00
hwpoison-inject.c
init-mm.c
internal.h
interval_tree.c
Kconfig
Kconfig.debug
khugepaged.c	mm: get rid of __GFP_OTHER_NODE	2017-01-10 18:31:55 -08:00
kmemcheck.c
kmemleak-test.c
kmemleak.c
ksm.c
list_lru.c
maccess.c
madvise.c
Makefile
memblock.c
memcontrol.c	mm, memcg: fix the active list aging for lowmem requests when memcg is enabled	2017-01-10 18:31:55 -08:00
memory_hotplug.c
memory-failure.c
memory.c	dax: wrprotect pmd_t in dax_mapping_entry_mkclean	2017-01-10 18:31:54 -08:00
mempolicy.c
mempool.c
memtest.c
migrate.c
mincore.c
mlock.c
mm_init.c
mmap.c
mmu_context.c
mmu_notifier.c
mmzone.c
mprotect.c
mremap.c
msync.c
nobootmem.c
nommu.c
oom_kill.c
page_alloc.c	mm: rename __page_frag functions to __page_frag_cache, drop order from drain	2017-01-10 18:31:55 -08:00
page_counter.c
page_ext.c
page_idle.c
page_io.c
page_isolation.c
page_owner.c
page_poison.c
page-writeback.c
pagewalk.c
percpu-km.c
percpu-vm.c
percpu.c
pgtable-generic.c
process_vm_access.c
quicklist.c
readahead.c
rmap.c
shmem.c
slab_common.c
slab.c	mm/slab.c: fix SLAB freelist randomization duplicate entries	2017-01-10 18:31:55 -08:00
slab.h
slob.c
slub.c
sparse-vmemmap.c
sparse.c
swap_cgroup.c
swap_state.c
swap.c
swapfile.c	mm: support anonymous stable page	2017-01-10 18:31:55 -08:00
truncate.c
usercopy.c
userfaultfd.c
util.c
vmacache.c
vmalloc.c
vmpressure.c
vmscan.c	mm, memcg: fix the active list aging for lowmem requests when memcg is enabled	2017-01-10 18:31:55 -08:00
vmstat.c
workingset.c	mm: workingset: fix use-after-free in shadow node shrinker	2017-01-07 18:22:40 -08:00
z3fold.c
zbud.c
zpool.c
zsmalloc.c
zswap.c