Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit db203d53 authored by Nick Piggin's avatar Nick Piggin Committed by Linus Torvalds
Browse files

mm: tiny-shmem fix lock ordering: mmap_sem vs i_mutex 



tiny-shmem calls do_truncate in shmem_file_setup.  do_truncate takes
i_mutex, and shmem_file_setup is called with mmap_sem held.  However
i_mutex nests outside mmap_sem.

Copy the code in shmem.c to avoid this problem.

[akpm@linux-foundation.org: coding-style fixes]
Signed-off-by: default avatarNick Piggin <npiggin@suse.de>
Reported-and-tested-by: default avatarIngo Molnar <mingo@elte.hu>
Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: Matt Mackall <mpm@selenic.com>
Cc: Hugh Dickins <hugh@veritas.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 2d4c8266

mm/tiny-shmem.c

+9 −15
Original line number Diff line number Diff line
@@ -65,31 +65,25 @@ struct file *shmem_file_setup(char *name, loff_t size, unsigned long flags) 
	if (!dentry)

		goto put_memory;



	error = -ENOSPC;

	inode = ramfs_get_inode(root->d_sb, S_IFREG | S_IRWXUGO, 0);

	if (!inode)

		goto put_dentry;



	d_instantiate(dentry, inode);

	error = -ENFILE;

	file = alloc_file(shm_mnt, dentry, FMODE_WRITE | FMODE_READ,

			&ramfs_file_operations);

	file = get_empty_filp();

	if (!file)

		goto put_dentry;



	inode->i_nlink = 0;	/* It is unlinked */



	/* notify everyone as to the change of file size */

	error = do_truncate(dentry, size, 0, file);

	if (error < 0)

	error = -ENOSPC;

	inode = ramfs_get_inode(root->d_sb, S_IFREG | S_IRWXUGO, 0);

	if (!inode)

		goto close_file;



	d_instantiate(dentry, inode);

	inode->i_size = size;

	inode->i_nlink = 0;	/* It is unlinked */

	init_file(file, shm_mnt, dentry, FMODE_WRITE | FMODE_READ,

			&ramfs_file_operations);

	return file;



close_file:

	put_filp(file);

	return ERR_PTR(error);



put_dentry:

	dput(dentry);

put_memory: