Messages in this thread | | | Date | Thu, 19 Jan 2017 19:16:51 +0100 | From | Greg KH <> | Subject | Re: [PATCH] mm/hugetlb.c: fix reservation race when freeing surplus pages |
| |
On Mon, Jan 09, 2017 at 11:56:07AM -0800, Mike Kravetz wrote: > The routine return_unused_surplus_pages decrements the global > reservation count, and frees any unused surplus pages that were > backing the reservation. Commit 7848a4bf51b3 ("mm/hugetlb.c: > add cond_resched_lock() in return_unused_surplus_pages()") added > a call to cond_resched_lock in the loop freeing the pages. As > a result, the hugetlb_lock could be dropped, and someone else > could use the pages that will be freed in subsequent iterations > of the loop. This could result in inconsistent global hugetlb > page state, application api failures (such as mmap) failures or > application crashes. > > When dropping the lock in return_unused_surplus_pages, make sure > that the global reservation count (resv_huge_pages) remains > sufficiently large to prevent someone else from claiming pages > about to be freed. > > Fixes: 7848a4bf51b3 ("mm/hugetlb.c: add cond_resched_lock() in return_unused_surplus_pages()") > Reported-and-analyzed-by: Paul Cassella <cassella@cray.com> > Suggested-by: Michal Hocko <mhocko@kernel.org> > Signed-off-by: Mike Kravetz <mike.kravetz@oracle.com> > --- > mm/hugetlb.c | 37 ++++++++++++++++++++++++++++--------- > 1 file changed, 28 insertions(+), 9 deletions(-)
<formletter>
This is not the correct way to submit patches for inclusion in the stable kernel tree. Please read Documentation/stable_kernel_rules.txt for how to do this properly.
</formletter>
| |