aboutsummaryrefslogtreecommitdiffstats
path: root/include/rdma
diff options
context:
space:
mode:
authorEric Dumazet <edumazet@google.com>2012-06-12 15:24:40 +0200
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2013-10-05 07:00:40 -0700
commit2e4e7cb96933d2c9794125b038bd9ea9cba9bcfc (patch)
tree970f9c0f3c329128caa6ad16ba8bb8926072cc08 /include/rdma
parent96ec909de79e2cc422126fdeb427fe8d0ffb4b95 (diff)
downloadkernel_samsung_smdk4412-2e4e7cb96933d2c9794125b038bd9ea9cba9bcfc.zip
kernel_samsung_smdk4412-2e4e7cb96933d2c9794125b038bd9ea9cba9bcfc.tar.gz
kernel_samsung_smdk4412-2e4e7cb96933d2c9794125b038bd9ea9cba9bcfc.tar.bz2
splice: fix racy pipe->buffers uses
commit 047fe3605235888f3ebcda0c728cb31937eadfe6 upstream. Dave Jones reported a kernel BUG at mm/slub.c:3474! triggered by splice_shrink_spd() called from vmsplice_to_pipe() commit 35f3d14dbbc5 (pipe: add support for shrinking and growing pipes) added capability to adjust pipe->buffers. Problem is some paths don't hold pipe mutex and assume pipe->buffers doesn't change for their duration. Fix this by adding nr_pages_max field in struct splice_pipe_desc, and use it in place of pipe->buffers where appropriate. splice_shrink_spd() loses its struct pipe_inode_info argument. Reported-by: Dave Jones <davej@redhat.com> Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: Jens Axboe <axboe@kernel.dk> Cc: Alexander Viro <viro@zeniv.linux.org.uk> Cc: Tom Herbert <therbert@google.com> Cc: stable <stable@vger.kernel.org> # 2.6.35 Tested-by: Dave Jones <davej@redhat.com> Signed-off-by: Jens Axboe <axboe@kernel.dk> Signed-off-by: Jiri Slaby <jslaby@suse.cz> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'include/rdma')
0 files changed, 0 insertions, 0 deletions