diff options
| author | Radim Krčmář <rkrcmar@redhat.com> | 2017-09-08 14:40:43 +0200 |
|---|---|---|
| committer | Radim Krčmář <rkrcmar@redhat.com> | 2017-09-08 14:40:43 +0200 |
| commit | 5f54c8b2d4fad95d1f8ecbe023ebe6038e6d3760 (patch) | |
| tree | daca83ea5f9af1bd158504bd0b5af89c5a99b7fa /mm/shmem.c | |
| parent | Merge branch 'kvm-ppc-next' of git://git.kernel.org/pub/scm/linux/kernel/git/... (diff) | |
| parent | KVM: PPC: Book3S HV: Protect updates to spapr_tce_tables list (diff) | |
| download | linux-5f54c8b2d4fad95d1f8ecbe023ebe6038e6d3760.tar.xz linux-5f54c8b2d4fad95d1f8ecbe023ebe6038e6d3760.zip | |
Merge branch 'kvm-ppc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc
This fix was intended for 4.13, but didn't get in because both
maintainers were on vacation.
Paul Mackerras:
"It adds mutual exclusion between list_add_rcu and list_del_rcu calls
on the kvm->arch.spapr_tce_tables list. Without this, userspace could
potentially trigger corruption of the list and cause a host crash or
worse."
Diffstat (limited to 'mm/shmem.c')
| -rw-r--r-- | mm/shmem.c | 12 |
1 files changed, 10 insertions, 2 deletions
diff --git a/mm/shmem.c b/mm/shmem.c index b0aa6075d164..6540e5982444 100644 --- a/mm/shmem.c +++ b/mm/shmem.c @@ -1022,7 +1022,11 @@ static int shmem_setattr(struct dentry *dentry, struct iattr *attr) */ if (IS_ENABLED(CONFIG_TRANSPARENT_HUGE_PAGECACHE)) { spin_lock(&sbinfo->shrinklist_lock); - if (list_empty(&info->shrinklist)) { + /* + * _careful to defend against unlocked access to + * ->shrink_list in shmem_unused_huge_shrink() + */ + if (list_empty_careful(&info->shrinklist)) { list_add_tail(&info->shrinklist, &sbinfo->shrinklist); sbinfo->shrinklist_len++; @@ -1817,7 +1821,11 @@ alloc_nohuge: page = shmem_alloc_and_acct_page(gfp, info, sbinfo, * to shrink under memory pressure. */ spin_lock(&sbinfo->shrinklist_lock); - if (list_empty(&info->shrinklist)) { + /* + * _careful to defend against unlocked access to + * ->shrink_list in shmem_unused_huge_shrink() + */ + if (list_empty_careful(&info->shrinklist)) { list_add_tail(&info->shrinklist, &sbinfo->shrinklist); sbinfo->shrinklist_len++; |