• Mike Kravetz's avatar
    hugetlbfs: remove call to huge_pte_alloc without i_mmap_rwsem · 34ae204f
    Mike Kravetz authored
    Commit c0d0381a ("hugetlbfs: use i_mmap_rwsem for more pmd sharing
    synchronization") requires callers of huge_pte_alloc to hold i_mmap_rwsem
    in at least read mode.  This is because the explicit locking in
    huge_pmd_share (called by huge_pte_alloc) was removed.  When restructuring
    the code, the call to huge_pte_alloc in the else block at the beginning of
    hugetlb_fault was missed.
    
    Unfortunately, that else clause is exercised when there is no page table
    entry.  This will likely lead to a call to huge_pmd_share.  If
    huge_pmd_share thinks pmd sharing is possible, it will traverse the
    mapping tree (i_mmap) without holding i_mmap_rwsem.  If someone else is
    modifying the tree, bad things such as addressing exceptions or worse
    could happen.
    
    Simply remove the else clause.  It should have been removed previously.
    The code following the else will call huge_pte_alloc with the appropriate
    locking.
    
    To prevent this type of issue in the future, add routines to assert that
    i_mmap_rwsem is held, and call these routines in huge pmd sharing
    routines.
    
    Fixes: c0d0381a ("hugetlbfs: use i_mmap_rwsem for more pmd sharing synchronization")
    Suggested-by: default avatarMatthew Wilcox <willy@infradead.org>
    Signed-off-by: default avatarMike Kravetz <mike.kravetz@oracle.com>
    Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
    Cc: Michal Hocko <mhocko@kernel.org>
    Cc: Hugh Dickins <hughd@google.com>
    Cc: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
    Cc: "Aneesh Kumar K.V" <aneesh.kumar@linux.vnet.ibm.com>
    Cc: Andrea Arcangeli <aarcange@redhat.com>
    Cc: "Kirill A.Shutemov" <kirill.shutemov@linux.intel.com>
    Cc: Davidlohr Bueso <dave@stgolabs.net>
    Cc: Prakash Sangappa <prakash.sangappa@oracle.com>
    Cc: <stable@vger.kernel.org>
    Link: http://lkml.kernel.org/r/e670f327-5cf9-1959-96e4-6dc7cc30d3d5@oracle.comSigned-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    34ae204f
rmap.c 55.5 KB