• Eric Dumazet's avatar
    splice: fix racy pipe->buffers uses · 047fe360
    Eric Dumazet authored
    Dave Jones reported a kernel BUG at mm/slub.c:3474! triggered
    by splice_shrink_spd() called from vmsplice_to_pipe()
    
    commit 35f3d14d (pipe: add support for shrinking and growing pipes)
    added capability to adjust pipe->buffers.
    
    Problem is some paths don't hold pipe mutex and assume pipe->buffers
    doesn't change for their duration.
    
    Fix this by adding nr_pages_max field in struct splice_pipe_desc, and
    use it in place of pipe->buffers where appropriate.
    
    splice_shrink_spd() loses its struct pipe_inode_info argument.
    Reported-by: default avatarDave Jones <davej@redhat.com>
    Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
    Cc: Jens Axboe <axboe@kernel.dk>
    Cc: Alexander Viro <viro@zeniv.linux.org.uk>
    Cc: Tom Herbert <therbert@google.com>
    Cc: stable <stable@vger.kernel.org> # 2.6.35
    Tested-by: default avatarDave Jones <davej@redhat.com>
    Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
    047fe360
shmem.c 77.6 KB