kernel_samsung_sm7125

jenna

History

Hugh Dickins 353d5c30c6 mm: fix hugetlb bug due to user_shm_unlock call 2.6.30's commit `8a0bdec194` removed user_shm_lock() calls in hugetlb_file_setup() but left the user_shm_unlock call in shm_destroy(). In detail: Assume that can_do_hugetlb_shm() returns true and hence user_shm_lock() is not called in hugetlb_file_setup(). However, user_shm_unlock() is called in any case in shm_destroy() and in the following atomic_dec_and_lock(&up->__count) in free_uid() is executed and if up->__count gets zero, also cleanup_user_struct() is scheduled. Note that sched_destroy_user() is empty if CONFIG_USER_SCHED is not set. However, the ref counter up->__count gets unexpectedly non-positive and the corresponding structs are freed even though there are live references to them, resulting in a kernel oops after a lots of shmget(SHM_HUGETLB)/shmctl(IPC_RMID) cycles and CONFIG_USER_SCHED set. Hugh changed Stefan's suggested patch: can_do_hugetlb_shm() at the time of shm_destroy() may give a different answer from at the time of hugetlb_file_setup(). And fixed newseg()'s no_id error path, which has missed user_shm_unlock() ever since it came in 2.6.9. Reported-by: Stefan Huber <shuber2@gmail.com> Signed-off-by: Hugh Dickins <hugh.dickins@tiscali.co.uk> Tested-by: Stefan Huber <shuber2@gmail.com> Cc: stable@kernel.org Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>		16 years ago
..
Makefile	…
compat.c	…
compat_mq.c	…
ipc_sysctl.c	…
ipcns_notifier.c	…
mq_sysctl.c	namespaces: move get_mq() inside #ifdef CONFIG_SYSCTL	16 years ago
mqueue.c	integrity: ima mq_open imbalance msg fix	16 years ago
msg.c	…
msgutil.c	…
namespace.c	ipcns: make free_ipc_ns() static	16 years ago
sem.c	rculist: use list_entry_rcu in places where it's appropriate	16 years ago
shm.c	mm: fix hugetlb bug due to user_shm_unlock call	16 years ago
util.c	…
util.h	ipc: unbreak 32-bit shmctl/semctl/msgctl	16 years ago