diff options
| author | Eric Dumazet <edumazet@google.com> | 2012-06-12 15:24:40 +0200 |
|---|---|---|
| committer | Jens Axboe <axboe@kernel.dk> | 2012-06-13 21:16:42 +0200 |
| commit | 047fe3605235888f3ebcda0c728cb31937eadfe6 (patch) | |
| tree | 9c33ef4b076bd54f686afe924cee01e21c55f427 /scripts/package | |
| parent | 27e1f9d1cc87be4e53c6eb7158cafc21c4b85a14 (diff) | |
| download | kernel-common-047fe3605235888f3ebcda0c728cb31937eadfe6.tar.gz kernel-common-047fe3605235888f3ebcda0c728cb31937eadfe6.tar.bz2 kernel-common-047fe3605235888f3ebcda0c728cb31937eadfe6.zip | |
splice: fix racy pipe->buffers uses
Dave Jones reported a kernel BUG at mm/slub.c:3474! triggered
by splice_shrink_spd() called from vmsplice_to_pipe()
commit 35f3d14dbbc5 (pipe: add support for shrinking and growing pipes)
added capability to adjust pipe->buffers.
Problem is some paths don't hold pipe mutex and assume pipe->buffers
doesn't change for their duration.
Fix this by adding nr_pages_max field in struct splice_pipe_desc, and
use it in place of pipe->buffers where appropriate.
splice_shrink_spd() loses its struct pipe_inode_info argument.
Reported-by: Dave Jones <davej@redhat.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Jens Axboe <axboe@kernel.dk>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Cc: Tom Herbert <therbert@google.com>
Cc: stable <stable@vger.kernel.org> # 2.6.35
Tested-by: Dave Jones <davej@redhat.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Diffstat (limited to 'scripts/package')
0 files changed, 0 insertions, 0 deletions