Eric Lee / smarc-fsl-linux-kernel

14 Oct, 2020

1 commit

  • e320d3012   mm/page_alloc.c: fix freeing non-compound pages ... Browse Code ยป

    Here is a very rare race which leaks memory:

    Page P0 is allocated to the page cache. Page P1 is free.

    Thread A Thread B Thread C
    find_get_entry():
    xas_load() returns P0
    Removes P0 from page cache
    P0 finds its buddy P1
    alloc_pages(GFP_KERNEL, 1) returns P0
    P0 has refcount 1
    page_cache_get_speculative(P0)
    P0 has refcount 2
    __free_pages(P0)
    P0 has refcount 1
    put_page(P0)
    P1 is not freed

    Fix this by freeing all the pages in __free_pages() that won't be freed
    by the call to put_page(). It's usually not a good idea to split a page,
    but this is a very unlikely scenario.

    Fixes: e286781d5f2e ("mm: speculative page references")
    Signed-off-by: Matthew Wilcox (Oracle)
    Signed-off-by: Andrew Morton
    Acked-by: Mike Rapoport
    Cc: Nick Piggin
    Cc: Hugh Dickins
    Cc: Peter Zijlstra
    Link: https://lkml.kernel.org/r/20200926213919.26642-1-willy@infradead.org
    Signed-off-by: Linus Torvalds

    Matthew Wilcox (Oracle)