[PATCH] hugepage: fix add_to_page_cache() error handling

From: David Gibson <david@gibson.dropbear.id.au>

add_to_page_cache() locks the given page if and only if it suceeds.  The
hugepage code (every arch), however, does an unlock_page() after
add_to_page_cache() before checking the return code, which could trip the
BUG() in unlock_page() if add_to_page_cache() failed.

In practice we've never hit this bug, because the only ways
add_to_page_cache() can fail are when we fail to allocate a radix tree node
(very rare), or when there is already a page at that offset in the radix
tree, which never happens during prefault, obviously.  We should probably
fix it anyway, though.

The analagous bug in some of the patches floating about to
demand-allocation of hugepages is more of a problem, because multiple
processes can race to instantiate a particular page in the radix tree -
that's been hit at least once (which is how I found this).

arch/i386/mm/hugetlbpage.c

@@ -264,8 +264,9 @@ int hugetlb_prefault(struct address_space *mapping, struct vm_area_struct *vma)
 				goto out;
 			}
 			ret = add_to_page_cache(page, mapping, idx, GFP_ATOMIC);
+			if (! ret) {
 				unlock_page(page);
-			if (ret) {
+			} else {
 				hugetlb_put_quota(mapping);
 				free_huge_page(page);
 				goto out;

arch/ia64/mm/hugetlbpage.c

@@ -293,8 +293,9 @@ int hugetlb_prefault(struct address_space *mapping, struct vm_area_struct *vma)
 				goto out;
 			}
 			ret = add_to_page_cache(page, mapping, idx, GFP_ATOMIC);
+			if (! ret) {
 				unlock_page(page);
-			if (ret) {
+			} else {
 				hugetlb_put_quota(mapping);
 				free_huge_page(page);
 				goto out;

arch/ppc64/mm/hugetlbpage.c

@@ -452,8 +452,9 @@ int hugetlb_prefault(struct address_space *mapping, struct vm_area_struct *vma)
 				goto out;
 			}
 			ret = add_to_page_cache(page, mapping, idx, GFP_ATOMIC);
+			if (! ret) {
 				unlock_page(page);
-			if (ret) {
+			} else {
 				hugetlb_put_quota(mapping);
 				free_huge_page(page);
 				goto out;

arch/sh/mm/hugetlbpage.c

@@ -248,8 +248,9 @@ int hugetlb_prefault(struct address_space *mapping, struct vm_area_struct *vma)
 				goto out;
 			}
 			ret = add_to_page_cache(page, mapping, idx, GFP_ATOMIC);
+			if (! ret) {
 				unlock_page(page);
-			if (ret) {
+			} else {
 				hugetlb_put_quota(mapping);
 				free_huge_page(page);
 				goto out;

arch/sparc64/mm/hugetlbpage.c

@@ -245,8 +245,9 @@ int hugetlb_prefault(struct address_space *mapping, struct vm_area_struct *vma)
 				goto out;
 			}
 			ret = add_to_page_cache(page, mapping, idx, GFP_ATOMIC);
+			if (! ret) {
 				unlock_page(page);
-			if (ret) {
+			} else {
 				hugetlb_put_quota(mapping);
 				free_huge_page(page);
 				goto out;