Please sign in to comment.
splice: fix racy pipe->buffers uses
Dave Jones reported a kernel BUG at mm/slub.c:3474! triggered by splice_shrink_spd() called from vmsplice_to_pipe() commit 35f3d14 (pipe: add support for shrinking and growing pipes) added capability to adjust pipe->buffers. Problem is some paths don't hold pipe mutex and assume pipe->buffers doesn't change for their duration. Fix this by adding nr_pages_max field in struct splice_pipe_desc, and use it in place of pipe->buffers where appropriate. splice_shrink_spd() loses its struct pipe_inode_info argument. Reported-by: Dave Jones <email@example.com> Signed-off-by: Eric Dumazet <firstname.lastname@example.org> Cc: Jens Axboe <email@example.com> Cc: Alexander Viro <firstname.lastname@example.org> Cc: Tom Herbert <email@example.com> Cc: stable <firstname.lastname@example.org> # 2.6.35 Tested-by: Dave Jones <email@example.com> Signed-off-by: Jens Axboe <firstname.lastname@example.org>
- Loading branch information...
Showing with 34 additions and 24 deletions.