diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2013-12-12 09:38:42 -0800 |
|---|---|---|
| committer | Ben Hutchings <ben@decadent.org.uk> | 2014-01-03 04:33:31 +0000 |
| commit | 96e7025c23fe7d09401edbfa8990144cbf8dc93b (patch) | |
| tree | 6539fc8c265f4c52c7c929a1746bc70aa6af8e9a /kernel/futex.c | |
| parent | cf3f5a3dbf78b72541dc9f295101cb90a5465d5c (diff) | |
| download | kernel_samsung_smdk4412-96e7025c23fe7d09401edbfa8990144cbf8dc93b.zip kernel_samsung_smdk4412-96e7025c23fe7d09401edbfa8990144cbf8dc93b.tar.gz kernel_samsung_smdk4412-96e7025c23fe7d09401edbfa8990144cbf8dc93b.tar.bz2 | |
futex: fix handling of read-only-mapped hugepages
commit f12d5bfceb7e1f9051563381ec047f7f13956c3c upstream.
The hugepage code had the exact same bug that regular pages had in
commit 7485d0d3758e ("futexes: Remove rw parameter from
get_futex_key()").
The regular page case was fixed by commit 9ea71503a8ed ("futex: Fix
regression with read only mappings"), but the transparent hugepage case
(added in a5b338f2b0b1: "thp: update futex compound knowledge") case
remained broken.
Found by Dave Jones and his trinity tool.
Reported-and-tested-by: Dave Jones <davej@fedoraproject.org>
Acked-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Mel Gorman <mgorman@suse.de>
Cc: Darren Hart <dvhart@linux.intel.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Diffstat (limited to 'kernel/futex.c')
| -rw-r--r-- | kernel/futex.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/kernel/futex.c b/kernel/futex.c index 1d0538e..8888815 100644 --- a/kernel/futex.c +++ b/kernel/futex.c @@ -285,7 +285,7 @@ again: put_page(page); /* serialize against __split_huge_page_splitting() */ local_irq_disable(); - if (likely(__get_user_pages_fast(address, 1, 1, &page) == 1)) { + if (likely(__get_user_pages_fast(address, 1, !ro, &page) == 1)) { page_head = compound_head(page); /* * page_head is valid pointer but we must pin |