Repository files (latest commit first)

Filename	Latest commit message	Latest commit date
Linus Torvalds 10d20bd25e shmem: fix shm fallocate() list corruption ... The shmem hole punching with fallocate(FALLOC_FL_PUNCH_HOLE) does not want to race with generating new pages by faulting them in. However, the wait-queue used to delay the page faulting has a serious problem: the wait queue head (in shmem_fallocate()) is allocated on the stack, and the code expects that "wake_up_all()" will make sure that all the queue entries are gone before the stack frame is de-allocated. And that is not at all necessarily the case. Yes, a normal wake-up sequence will remove the wait-queue entry that caused the wakeup (see "autoremove_wake_function()"), but the key wording there is "that caused the wakeup". When there are multiple possible wakeup sources, the wait queue entry may well stay around. And _particularly_ in a page fault path, we may be faulting in new pages from user space while we also have other things going on, and there may well be other pending wakeups. So despite the "wake_up_all()", it's not at all guaranteed that all list entries are removed from the wait queue head on the stack. Fix this by introducing a new wakeup function that removes the list entry unconditionally, even if the target process had already woken up for other reasons. Use that "synchronous" function to set up the waiters in shmem_fault(). This problem has never been seen in the wild afaik, but Dave Jones has reported it on and off while running trinity. We thought we fixed the stack corruption with the blk-mq rq_list locking fix (commit 7fe311302f: "blk-mq: update hardware and software queues for sleeping alloc"), but it turns out there was _another_ stack corruptor hiding in the trinity runs. Vegard Nossum (also running trinity) was able to trigger this one fairly consistently, and made us look once again at the shmem code due to the faults often being in that area. Reported-and-tested-by: Vegard Nossum <vegard.nossum@oracle.com>. Reported-by: Dave Jones <davej@codemonkey.org.uk> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>		2016-12-06 08:59:05 -08:00
..
kasan	kasan: support use-after-scope detection	2016-11-30 16:32:52 -08:00
backing-dev.c	block: fix bdi vs gendisk lifetime mismatch	2016-08-04 14:19:16 -06:00
balloon_compaction.c
bootmem.c	mm: kmemleak: avoid using __va() on addresses that don't have a lowmem mapping	2016-10-11 15:06:33 -07:00
cleancache.c
cma.c	mm/cma.c: check the max limit for cma allocation	2016-11-11 08:12:37 -08:00
cma.h
cma_debug.c
compaction.c	mm, compaction: restrict fragindex to costly orders	2016-10-07 18:46:29 -07:00
debug.c	mm: clarify why we avoid page_mapcount() for slab pages in dump_page()	2016-10-07 18:46:29 -07:00
debug_page_ref.c
dmapool.c
early_ioremap.c
fadvise.c
failslab.c
filemap.c	mm/filemap: don't allow partially uptodate page for pipes	2016-11-11 08:12:37 -08:00
frame_vector.c	mm: replace get_vaddr_frames() write/force parameters with gup_flags	2016-10-19 08:11:24 -07:00
frontswap.c
gup.c	mm: unexport __get_user_pages()	2016-10-24 19:13:20 -07:00
highmem.c
huge_memory.c	mremap: move_ptes: check pte dirty after its removal	2016-11-29 08:20:24 -08:00
hugetlb.c	mm/hugetlb: fix huge page reservation leak in private mapping error paths	2016-11-11 08:12:37 -08:00
hugetlb_cgroup.c
hwpoison-inject.c
init-mm.c
internal.h	mm, compaction: make full priority ignore pageblock suitability	2016-10-07 18:46:29 -07:00
interval_tree.c
Kconfig	Allow KASAN and HOTPLUG_MEMORY to co-exist when doing build testing	2016-10-27 16:23:01 -07:00
Kconfig.debug	PM / Hibernate: allow hibernation with PAGE_POISONING_ZERO	2016-09-13 02:35:27 +02:00
khugepaged.c	mm, thp: propagation of conditional compilation in khugepaged.c	2016-11-30 16:32:52 -08:00
kmemcheck.c
kmemleak-test.c
kmemleak.c	mm: kmemleak: scan .data.ro_after_init	2016-11-11 08:12:37 -08:00
ksm.c	mm,ksm: add __GFP_HIGH to the allocation in alloc_stable_node()	2016-10-07 18:46:29 -07:00
list_lru.c	mm/list_lru.c: avoid error-path NULL pointer deref	2016-10-27 18:43:42 -07:00
maccess.c
madvise.c
Makefile	Disable the __builtin_return_address() warning globally after all	2016-10-12 10:23:41 -07:00
memblock.c	mm: kmemleak: avoid using __va() on addresses that don't have a lowmem mapping	2016-10-11 15:06:33 -07:00
memcontrol.c	mm: memcontrol: do not recurse in direct reclaim	2016-10-27 18:43:43 -07:00
memory-failure.c	mm: hwpoison: fix thp split handling in memory_failure()	2016-11-11 08:12:37 -08:00
memory.c	mm: replace access_process_vm() write parameter with gup_flags	2016-10-19 08:31:25 -07:00
memory_hotplug.c	mm: remove unused variable in memory hotplug	2016-10-27 15:49:12 -07:00
mempolicy.c	mm: replace get_user_pages() write/force parameters with gup_flags	2016-10-19 08:11:43 -07:00
mempool.c	Revert "mm, mempool: only set __GFP_NOMEMALLOC if there are free elements"	2016-07-28 16:07:41 -07:00
memtest.c
migrate.c	mm: vm_page_prot: update with WRITE_ONCE/READ_ONCE	2016-10-07 18:46:29 -07:00
mincore.c	mm, swap: use offset of swap entry as key of swap cache	2016-10-07 18:46:28 -07:00
mlock.c	thp: fix corner case of munlock() of PTE-mapped THPs	2016-11-30 16:32:52 -08:00
mm_init.c
mmap.c	mm: vma_merge: correct false positive from __vma_unlink->validate_mm_rb	2016-10-07 18:46:29 -07:00
mmu_context.c
mmu_notifier.c
mmzone.c
mprotect.c	mm/numa: Remove duplicated include from mprotect.c	2016-10-19 17:28:48 +02:00
mremap.c	mremap: move_ptes: check pte dirty after its removal	2016-11-29 08:20:24 -08:00
msync.c
nobootmem.c	mm: kmemleak: avoid using __va() on addresses that don't have a lowmem mapping	2016-10-11 15:06:33 -07:00
nommu.c	mm: unexport __get_user_pages()	2016-10-24 19:13:20 -07:00
oom_kill.c	oom: print nodemask in the oom report	2016-10-07 18:46:29 -07:00
page-writeback.c	mm: don't use radix tree writeback tags for pages in swap cache	2016-10-07 18:46:28 -07:00
page_alloc.c	mm: remove extra newline from allocation stall warning	2016-11-11 08:12:37 -08:00
page_counter.c
page_ext.c	mm/page_ext: support extra space allocation by page_ext user	2016-10-07 18:46:27 -07:00
page_idle.c
page_io.c	mm/page_io.c: replace some BUG_ON()s with VM_BUG_ON_PAGE()	2016-10-07 18:46:29 -07:00
page_isolation.c	mm/page_isolation: fix typo: "paes" -> "pages"	2016-10-07 18:46:29 -07:00
page_owner.c	mm/page_owner: don't define fields on struct page_ext by hard-coding	2016-10-07 18:46:27 -07:00
page_poison.c
pagewalk.c
percpu-km.c
percpu-vm.c
percpu.c	mm/percpu.c: fix potential memory leakage for pcpu_embed_first_chunk()	2016-10-05 11:52:55 -04:00
pgtable-generic.c
process_vm_access.c	mm: remove write/force parameters from __get_user_pages_unlocked()	2016-10-18 14:13:37 -07:00
quicklist.c
readahead.c	mm: silently skip readahead for DAX inodes	2016-08-26 17:39:35 -07:00
rmap.c	rmap: fix compound check logic in page_remove_file_rmap	2016-08-10 16:40:56 -07:00
shmem.c	shmem: fix shm fallocate() list corruption	2016-12-06 08:59:05 -08:00
slab.c	mm/slab: improve performance of gathering slabinfo stats	2016-10-27 18:43:43 -07:00
slab.h	mm/slab: improve performance of gathering slabinfo stats	2016-10-27 18:43:43 -07:00
slab_common.c	memcg: prevent memcg caches to be both OFF_SLAB & OBJFREELIST_SLAB	2016-11-11 08:12:37 -08:00
slob.c
slub.c	slub: Convert to hotplug state machine	2016-09-06 18:30:20 +02:00
sparse-vmemmap.c	treewide: replace obsolete _refok by __ref	2016-08-02 17:31:41 -04:00
sparse.c	treewide: replace obsolete _refok by __ref	2016-08-02 17:31:41 -04:00
swap.c	thp: reduce usage of huge zero page's atomic counter	2016-10-07 18:46:28 -07:00
swap_cgroup.c
swap_state.c	mm, swap: use offset of swap entry as key of swap cache	2016-10-07 18:46:28 -07:00
swapfile.c	swapfile: fix memory corruption via malformed swapfile	2016-11-11 08:12:37 -08:00
truncate.c	mm: fix false-positive WARN_ON() in truncate/invalidate for hugetlb	2016-11-30 16:32:52 -08:00
usercopy.c	mm: usercopy: Check for module addresses	2016-09-20 16:07:39 -07:00
userfaultfd.c
util.c	Merge branch 'mm-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2016-10-22 09:39:10 -07:00
vmacache.c	mm: unrig VMA cache hit ratio	2016-10-07 18:46:27 -07:00
vmalloc.c	mm: consolidate warn_alloc_failed users	2016-10-07 18:46:29 -07:00
vmpressure.c
vmscan.c	mm, vmscan: add cond_resched() into shrink_node_memcg()	2016-12-02 18:48:03 -08:00
vmstat.c	seq/proc: modify seq_put_decimal_[u]ll to take a const char *, not char	2016-10-07 18:46:30 -07:00
workingset.c	mm: workingset: fix NULL ptr in count_shadow_nodes	2016-12-02 18:48:03 -08:00
z3fold.c
zbud.c
zpool.c
zsmalloc.c	zsmalloc: Delete an unnecessary check before the function call "iput"	2016-07-28 16:07:41 -07:00
zswap.c