David Rientjes def52acc90 mm: close PageTail race ... commit 668f9abbd4 upstream. Commit bf6bddf192 ("mm: introduce compaction and migration for ballooned pages") introduces page_count(page) into memory compaction which dereferences page->first_page if PageTail(page). This results in a very rare NULL pointer dereference on the aforementioned page_count(page). Indeed, anything that does compound_head(), including page_count() is susceptible to racing with prep_compound_page() and seeing a NULL or dangling page->first_page pointer. This patch uses Andrea's implementation of compound_trans_head() that deals with such a race and makes it the default compound_head() implementation. This includes a read memory barrier that ensures that if PageTail(head) is true that we return a head page that is neither NULL nor dangling. The patch then adds a store memory barrier to prep_compound_page() to ensure page->first_page is set. This is the safest way to ensure we see the head page that we are expecting, PageTail(page) is already in the unlikely() path and the memory barriers are unfortunately required. Hugetlbfs is the exception, we don't enforce a store memory barrier during init since no race is possible. Signed-off-by: David Rientjes <rientjes@google.com> Cc: Holger Kiehl <Holger.Kiehl@dwd.de> Cc: Christoph Lameter <cl@linux.com> Cc: Rafael Aquini <aquini@redhat.com> Cc: Vlastimil Babka <vbabka@suse.cz> Cc: Michal Hocko <mhocko@suse.cz> Cc: Mel Gorman <mgorman@suse.de> Cc: Andrea Arcangeli <aarcange@redhat.com> Cc: Rik van Riel <riel@redhat.com> Cc: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2014-04-03 12:01:05 -07:00
..
acpi	ACPI / hotplug: Fix conflicted PCI bridge notify handlers	2013-12-04 10:57:04 -08:00
asm-generic	mm: fix TLB flush race between migration, and change_protection_range	2014-01-09 12:24:23 -08:00
clocksource	clocksource: arch_timer: use virtual counters	2014-01-09 12:24:26 -08:00
crypto	crypto: scatterwalk - Use sg_chain_ptr on chain entries	2013-12-11 22:36:29 -08:00
drm	drm/radeon: 0x9649 is SUMO2 not SUMO	2014-01-09 12:24:22 -08:00
dt-bindings	ARM: dt: create a DT header for the GIC	2013-04-05 12:23:24 -06:00
keys
linux	mm: close PageTail race	2014-04-03 12:01:05 -07:00
math-emu
media	media: v4l2: added missing mutex.h include to v4l2-ctrls.h	2013-09-26 17:18:26 -07:00
memory
misc
net	net-tcp: fastopen: fix high order allocations	2014-03-23 21:38:10 -07:00
pcmcia
ras
rdma
rxrpc
scsi	ore: Fix wrong math in allocation of per device BIO	2014-02-13 13:48:00 -08:00
sound	ALSA: memalloc.h - fix wrong truncation of dma_addr_t	2013-12-20 07:45:06 -08:00
target	iscsi/iser-target: Fix isert_conn->state hung shutdown issues	2014-03-23 21:38:21 -07:00
trace	tracing: Fix array size mismatch in format string	2014-03-31 09:58:12 -07:00
uapi	ALSA: compress: Fix 64bit ABI incompatibility	2013-12-20 07:45:06 -08:00
video	Merge branch 'fbdev-3.10-fixes' of git://gitorious.org/linux-omap-dss2/linux into linux-fbdev/for-3.10-fixes	2013-05-29 17:00:34 +08:00
xen	xenbus: delay xenbus frontend resume if xenstored is not running	2013-05-29 09:04:19 -04:00
Kbuild	UAPI: remove empty Kbuild files	2013-04-30 17:04:09 -07:00