Hugh Dickins 353d5c30c6 mm: fix hugetlb bug due to user_shm_unlock call ... 2.6.30's commit 8a0bdec194 removed user_shm_lock() calls in hugetlb_file_setup() but left the user_shm_unlock call in shm_destroy(). In detail: Assume that can_do_hugetlb_shm() returns true and hence user_shm_lock() is not called in hugetlb_file_setup(). However, user_shm_unlock() is called in any case in shm_destroy() and in the following atomic_dec_and_lock(&up->__count) in free_uid() is executed and if up->__count gets zero, also cleanup_user_struct() is scheduled. Note that sched_destroy_user() is empty if CONFIG_USER_SCHED is not set. However, the ref counter up->__count gets unexpectedly non-positive and the corresponding structs are freed even though there are live references to them, resulting in a kernel oops after a lots of shmget(SHM_HUGETLB)/shmctl(IPC_RMID) cycles and CONFIG_USER_SCHED set. Hugh changed Stefan's suggested patch: can_do_hugetlb_shm() at the time of shm_destroy() may give a different answer from at the time of hugetlb_file_setup(). And fixed newseg()'s no_id error path, which has missed user_shm_unlock() ever since it came in 2.6.9. Reported-by: Stefan Huber <shuber2@gmail.com> Signed-off-by: Hugh Dickins <hugh.dickins@tiscali.co.uk> Tested-by: Stefan Huber <shuber2@gmail.com> Cc: stable@kernel.org Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>		2009-08-24 12:53:01 -07:00
..
acpi	Revert "ACPICA: Remove obsolete acpi_os_validate_address interface"	2009-07-27 18:42:38 -04:00
asm-generic	mm: Pass virtual address to [__]p{te,ud,md}_free_tlb()	2009-07-27 12:10:38 -07:00
crypto
drm	drm/radeon: add GET_PARAM/INFO support for Z pipes	2009-08-21 19:10:30 +10:00
keys
linux	mm: fix hugetlb bug due to user_shm_unlock call	2009-08-24 12:53:01 -07:00
math-emu
media	V4L/DVB (12283): gspca - sn9c20x: New subdriver for sn9c201 and sn9c202 bridges.	2009-07-24 14:03:30 -03:00
mtd
net	pkt_sched: Convert qdisc_watchdog to tasklet_hrtimer	2009-08-22 18:09:17 -07:00
pcmcia
rdma
rxrpc
scsi	sd, sr: fix Driver 'sd' needs updating message	2009-06-21 12:01:27 -05:00
sound
trace	perf_counter: Zero dead bytes from ftrace raw samples size alignment	2009-08-10 16:51:19 +02:00
video	fbdev: s1d13xxxfb: add accelerated bitblt functions	2009-06-16 19:48:00 -07:00
xen
Kbuild