David Rientjes def52acc90 mm: close PageTail race ... commit 668f9abbd4334e6c29fa8acd71635c4f9101caa7 upstream. Commit bf6bddf192 ("mm: introduce compaction and migration for ballooned pages") introduces page_count(page) into memory compaction which dereferences page->first_page if PageTail(page). This results in a very rare NULL pointer dereference on the aforementioned page_count(page). Indeed, anything that does compound_head(), including page_count() is susceptible to racing with prep_compound_page() and seeing a NULL or dangling page->first_page pointer. This patch uses Andrea's implementation of compound_trans_head() that deals with such a race and makes it the default compound_head() implementation. This includes a read memory barrier that ensures that if PageTail(head) is true that we return a head page that is neither NULL nor dangling. The patch then adds a store memory barrier to prep_compound_page() to ensure page->first_page is set. This is the safest way to ensure we see the head page that we are expecting, PageTail(page) is already in the unlikely() path and the memory barriers are unfortunately required. Hugetlbfs is the exception, we don't enforce a store memory barrier during init since no race is possible. Signed-off-by: David Rientjes <rientjes@google.com> Cc: Holger Kiehl <Holger.Kiehl@dwd.de> Cc: Christoph Lameter <cl@linux.com> Cc: Rafael Aquini <aquini@redhat.com> Cc: Vlastimil Babka <vbabka@suse.cz> Cc: Michal Hocko <mhocko@suse.cz> Cc: Mel Gorman <mgorman@suse.de> Cc: Andrea Arcangeli <aarcange@redhat.com> Cc: Rik van Riel <riel@redhat.com> Cc: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2014-04-03 12:01:05 -07:00
..
array.c
base.c	fs/proc/base.c: fix GPF in /proc/$PID/map_files	2014-03-23 21:38:17 -07:00
cmdline.c
consoles.c
cpuinfo.c
devices.c
fd.c
fd.h	proc: Move proc_fd() to fs/proc/fd.h	2013-05-01 17:29:39 -04:00
generic.c	proc: Make the PROC_I() and PDE() macros internal to procfs	2013-05-01 17:29:47 -04:00
inode.c	proc: Split the namespace stuff out into linux/proc_ns.h	2013-05-01 17:29:39 -04:00
internal.h	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2013-05-01 17:51:54 -07:00
interrupts.c
Kconfig
kcore.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2013-05-01 17:51:54 -07:00
kmsg.c	kmsg: honor dmesg_restrict sysctl on /dev/kmsg	2013-06-12 16:29:44 -07:00
loadavg.c
Makefile
meminfo.c
namespaces.c	proc: Split the namespace stuff out into linux/proc_ns.h	2013-05-01 17:29:39 -04:00
nommu.c
page.c	mm: close PageTail race	2014-04-03 12:01:05 -07:00
proc_devtree.c	proc_devtree: Replace include linux/module.h with linux/export.h	2013-05-04 15:31:01 -04:00
proc_net.c	proc: Move PDE_NET() to fs/proc/proc_net.c	2013-05-01 17:29:40 -04:00
proc_sysctl.c
proc_tty.c
root.c	proc: Restrict mounting the proc filesystem	2013-09-26 17:18:28 -07:00
self.c
softirqs.c
stat.c
task_mmu.c	fs/proc/task_mmu.c: fix buffer overflow in add_page_map()	2013-08-20 08:43:02 -07:00
task_nommu.c
uptime.c
version.c
vmcore.c	proc: Supply a function to remove a proc entry by PDE	2013-05-01 17:29:46 -04:00