• Andrea Arcangeli's avatar
    [PATCH] fix for mpol mm corruption on tmpfs · fc2219b2
    Andrea Arcangeli authored
    With the inline symlink shmem_inode_info structure is overwritten with data
    until vfs_inode, and that caused the ->policy to be a corrupted pointer
    during unlink.  It wasn't immediatly easy to see what was going on due the
    random mm corruption that generated a weird oops, it looked more like a
    race condition on freed memory at first.
    
    There's simply no need to set a policy for inodes, since the idx is always
    zero.  All we have to do is to initialize the data structure (the semaphore
    may need to run during the page allocation for the non-inline symlink) but
    we don't need to allocate the rb nodes.  This way we don't need to call
    mpol_free during the destroy_inode (not doable at all if the policy rbtree
    is corrupt by the inline symlink ;).
    
    An equivalent version of this patch based on a 2.6.5 tree with additional
    numa features on top of this (i.e.  interleaved by default, and that's
    prompted me to add a comment in the LNK init path), works fine in a numa
    simulation on my laptop (untested on the bare hardware).
    Signed-off-by: default avatarAndrea Arcangeli <andrea@novell.com>
    Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
    Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
    fc2219b2
shmem.c 57.5 KB