Repository files (latest commit first)

Filename	Latest commit message	Latest commit date
Gang Li 6264d0fef9 shmem: fix a race between shmem_unused_huge_shrink and shmem_evict_inode ... commit 62c9827cbb996c2c04f615ecd783ce28bcea894b upstream. Fix a data race in commit 779750d20b ("shmem: split huge pages beyond i_size under memory pressure"). Here are call traces causing race: Call Trace 1: shmem_unused_huge_shrink+0x3ae/0x410 ? __list_lru_walk_one.isra.5+0x33/0x160 super_cache_scan+0x17c/0x190 shrink_slab.part.55+0x1ef/0x3f0 shrink_node+0x10e/0x330 kswapd+0x380/0x740 kthread+0xfc/0x130 ? mem_cgroup_shrink_node+0x170/0x170 ? kthread_create_on_node+0x70/0x70 ret_from_fork+0x1f/0x30 Call Trace 2: shmem_evict_inode+0xd8/0x190 evict+0xbe/0x1c0 do_unlinkat+0x137/0x330 do_syscall_64+0x76/0x120 entry_SYSCALL_64_after_hwframe+0x3d/0xa2 A simple explanation: Image there are 3 items in the local list (@list). In the first traversal, A is not deleted from @list. 1) A->B->C ^ | pos (leave) In the second traversal, B is deleted from @list. Concurrently, A is deleted from @list through shmem_evict_inode() since last reference counter of inode is dropped by other thread. Then the @list is corrupted. 2) A->B->C ^ ^ | | evict pos (drop) We should make sure the inode is either on the global list or deleted from any local list before iput(). Fixed by moving inodes back to global list before we put them. [akpm@linux-foundation.org: coding style fixes] Link: https://lkml.kernel.org/r/20211125064502.99983-1-ligang.bdlg@bytedance.com Fixes: 779750d20b ("shmem: split huge pages beyond i_size under memory pressure") Signed-off-by: Gang Li <ligang.bdlg@bytedance.com> Reviewed-by: Muchun Song <songmuchun@bytedance.com> Acked-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com> Cc: Hugh Dickins <hughd@google.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2022-01-27 09:19:29 +01:00
..
kasan	kasan: fix incorrect arguments passing in kasan_add_zero_shadow	2021-01-27 11:47:53 +01:00
backing-dev.c	mm: bdi: initialize bdi_min_ratio when bdi is unregistered	2021-12-14 14:49:00 +01:00
balloon_compaction.c
cleancache.c
cma.c	cma: don't quit at first error when activating reserved areas	2020-09-03 11:26:51 +02:00
cma.h
cma_debug.c
compaction.c	mm/compaction: fix misbehaviors of fast_find_migrateblock()	2021-03-04 10:26:39 +01:00
debug.c
debug_page_ref.c
dmapool.c
early_ioremap.c
fadvise.c
failslab.c
filemap.c	mm/filemap: fix storing to a THP shadow entry	2021-06-10 13:37:15 +02:00
frame_vector.c
frontswap.c
gup.c	mm/gup: fix gup_fast with dynamic page table folding	2020-10-01 13:18:24 +02:00
gup_benchmark.c
highmem.c
hmm.c
huge_memory.c	mm/huge_memory.c: don't discard hugepage if other processes are mapping it	2021-07-14 16:53:47 +02:00
hugetlb.c	hugetlbfs: flush TLBs correctly after huge_pmd_unshare	2021-11-26 10:47:23 +01:00
hugetlb_cgroup.c
hwpoison-inject.c
init-mm.c
internal.h	mm/thp: fix vma_address() if virtual address below file offset	2021-06-30 08:47:52 -04:00
interval_tree.c
Kconfig	mm/zsmalloc.c: drop ZSMALLOC_PGTABLE_MAPPING	2020-12-16 10:56:59 +01:00
Kconfig.debug
khugepaged.c	khugepaged: fix wrong result value for trace_mm_collapse_huge_page_isolate()	2021-05-19 10:08:27 +02:00
kmemleak-test.c
kmemleak.c	mm/kmemleak.c: use address-of operator on section symbols	2020-10-01 13:17:53 +02:00
ksm.c	ksm: fix potential missing rmap_item for stable_node	2021-05-19 10:08:27 +02:00
list_lru.c	mm: list_lru: set shrinker map bit when child nr_items is not zero	2020-12-11 13:23:31 +01:00
maccess.c
madvise.c	mm: validate pmd after splitting	2020-10-01 13:18:21 +02:00
Makefile
memblock.c	memblock: ensure there is no overflow in memblock_overlaps_region()	2021-12-17 10:12:24 +01:00
memcontrol.c	mm, memcg: avoid stale protection values when cgroup is above protection	2021-08-26 08:36:22 -04:00
memfd.c
memory-failure.c	mm/memory-failure: make sure wait for page writeback in memory_failure	2021-06-23 14:41:23 +02:00
memory.c	mm/thp: unmap_mapping_page() to fix THP truncate_cleanup_page()	2021-06-30 08:47:53 -04:00
memory_hotplug.c	mm/memory_hotplug: use "unsigned long" for PFN in zone_for_pfn_range()	2021-09-22 12:26:43 +02:00
mempolicy.c	mm: mempolicy: fix THP allocations escaping mempolicy restrictions	2021-12-29 12:23:37 +01:00
mempool.c
memremap.c
memtest.c
migrate.c	mm, thp: use head page in __migration_entry_wait()	2021-06-30 08:47:52 -04:00
mincore.c
mlock.c
mm_init.c
mmap.c	mm/mmap.c: initialize align_offset explicitly for vm_unmapped_area	2020-10-01 13:17:54 +02:00
mmu_context.c	mm: fix kthread_use_mm() vs TLB invalidate	2020-09-03 11:26:51 +02:00
mmu_gather.c
mmu_notifier.c
mmzone.c
mprotect.c
mremap.c
msync.c
nommu.c
oom_kill.c	mm, oom: do not trigger out_of_memory from the #PF	2021-11-17 09:48:50 +01:00
page-writeback.c
page_alloc.c	mm/page_alloc.c: do not warn allocation failure on zone DMA if no managed pages	2022-01-27 09:19:28 +01:00
page_counter.c	mm/page_counter.c: fix protection usage propagation	2020-08-21 13:05:27 +02:00
page_ext.c
page_idle.c
page_io.c	swap: fix swapfile read/write offset	2021-03-07 12:20:49 +01:00
page_isolation.c	mm/memory_hotplug: drain per-cpu pages again during memory offline	2020-09-23 12:40:47 +02:00
page_owner.c	mm/page_owner: change split_page_owner to take a count	2020-10-29 09:57:52 +01:00
page_poison.c
page_vma_mapped.c	mm/thp: another PVMW_SYNC fix in page_vma_mapped_walk()	2021-06-30 08:47:55 -04:00
pagewalk.c	mm: pagewalk: fix termination condition in walk_pte_range()	2020-10-01 13:17:30 +02:00
percpu-internal.h
percpu-km.c
percpu-stats.c
percpu-vm.c
percpu.c	percpu: fix first chunk size calculation for populated bitmap	2020-09-23 12:40:45 +02:00
pgtable-generic.c	mm/thp: fix __split_huge_pmd_locked() on shmem migration entry	2021-06-30 08:47:52 -04:00
process_vm_access.c
readahead.c
rmap.c	mm/thp: fix page_address_in_vma() on file THP tails	2021-06-30 08:47:53 -04:00
rodata_test.c
shmem.c	shmem: fix a race between shmem_unused_huge_shrink and shmem_evict_inode	2022-01-27 09:19:29 +01:00
shuffle.c	mm/shuffle: don't move pages between zones and don't read garbage memmaps	2020-09-03 11:26:51 +02:00
shuffle.h
slab.c
slab.h	mm: kmemleak: slob: respect SLAB_NOLEAKTRACE flag	2021-11-26 10:47:21 +01:00
slab_common.c	mm: slab: fix kmem_cache_create failed when sysfs node not destroyed	2021-07-25 14:35:14 +02:00
slob.c
slub.c	mm, slub: fix potential memoryleak in kmem_cache_open()	2021-10-27 09:54:28 +02:00
sparse-vmemmap.c
sparse.c	mm/sparse: add the missing sparse_buffer_fini() in error branch	2021-05-14 09:44:32 +02:00
swap.c
swap_cgroup.c
swap_slots.c
swap_state.c	mm/swap_state: fix a data race in swapin_nr_pages	2020-10-01 13:18:08 +02:00
swapfile.c	swap: fix swapfile read/write offset	2021-03-07 12:20:49 +01:00
truncate.c	mm/thp: unmap_mapping_page() to fix THP truncate_cleanup_page()	2021-06-30 08:47:53 -04:00
usercopy.c
userfaultfd.c	hugetlbfs: hugetlb_fault_mutex_hash() cleanup	2021-03-30 14:35:19 +02:00
util.c
vmacache.c
vmalloc.c	mm/vunmap: add cond_resched() in vunmap_pmd_range	2020-09-03 11:26:52 +02:00
vmpressure.c
vmscan.c	mm,vmscan: fix divide by zero in get_scan_count	2021-09-22 12:26:37 +02:00
vmstat.c
workingset.c
z3fold.c	mm/z3fold: fix potential memory leak in z3fold_destroy_pool()	2021-07-14 16:53:47 +02:00
zbud.c
zpool.c
zsmalloc.c	mm/zsmalloc.c: close race window between zs_pool_dec_isolated() and zs_unregister_migration()	2021-11-17 09:48:47 +01:00
zswap.c