)]}'
{
  "commit": "13665f1f8b5d501b40b1bc8448b0a032c7f04cc2",
  "tree": "1749c0e659b2c0980fde9da37aaaf8558d711967",
  "parents": [
    "65e7bf43bfc725aab161a6678c04bc359ba48532"
  ],
  "author": {
    "name": "Mike Kravetz",
    "email": "mike.kravetz@oracle.com",
    "time": "Tue Dec 29 15:14:25 2020 -0800"
  },
  "committer": {
    "name": "Sasha Levin",
    "email": "sashal@kernel.org",
    "time": "Tue Mar 23 20:27:22 2021 -0400"
  },
  "message": "mm/hugetlb: fix deadlock in hugetlb_cow error path\n\n[ Upstream commit e7dd91c456a8cdbcd7066997d15e36d14276a949 ]\n\nsyzbot reported the deadlock here [1].  The issue is in hugetlb cow\nerror handling when there are not enough huge pages for the faulting\ntask which took the original reservation.  It is possible that other\n(child) tasks could have consumed pages associated with the reservation.\nIn this case, we want the task which took the original reservation to\nsucceed.  So, we unmap any associated pages in children so that they can\nbe used by the faulting task that owns the reservation.\n\nThe unmapping code needs to hold i_mmap_rwsem in write mode.  However,\ndue to commit c0d0381ade79 (\"hugetlbfs: use i_mmap_rwsem for more pmd\nsharing synchronization\") we are already holding i_mmap_rwsem in read\nmode when hugetlb_cow is called.\n\nTechnically, i_mmap_rwsem does not need to be held in read mode for COW\nmappings as they can not share pmd\u0027s.  Modifying the fault code to not\ntake i_mmap_rwsem in read mode for COW (and other non-sharable) mappings\nis too involved for a stable fix.\n\nInstead, we simply drop the hugetlb_fault_mutex and i_mmap_rwsem before\nunmapping.  This is OK as it is technically not needed.  They are\nreacquired after unmapping as expected by calling code.  Since this is\ndone in an uncommon error path, the overhead of dropping and reacquiring\nmutexes is acceptable.\n\nWhile making changes, remove redundant BUG_ON after unmap_ref_private.\n\n[1] https://lkml.kernel.org/r/000000000000b73ccc05b5cf8558@google.com\n\nLink: https://lkml.kernel.org/r/4c5781b8-3b00-761e-c0c7-c5edebb6ec1a@oracle.com\nFixes: c0d0381ade79 (\"hugetlbfs: use i_mmap_rwsem for more pmd sharing synchronization\")\nSigned-off-by: Mike Kravetz \u003cmike.kravetz@oracle.com\u003e\nReported-by: syzbot+5eee4145df3c15e96625@syzkaller.appspotmail.com\nCc: Naoya Horiguchi \u003cn-horiguchi@ah.jp.nec.com\u003e\nCc: Michal Hocko \u003cmhocko@kernel.org\u003e\nCc: Hugh Dickins \u003chughd@google.com\u003e\nCc: \"Aneesh Kumar K . V\" \u003caneesh.kumar@linux.vnet.ibm.com\u003e\nCc: Davidlohr Bueso \u003cdave@stgolabs.net\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "261df47ffa9328bab5b52b49fc53e9e3d2c96fdc",
      "old_mode": 33188,
      "old_path": "mm/hugetlb.c",
      "new_id": "3d33eed923dca08fe4f3ced7f827b430e3b5e54b",
      "new_mode": 33188,
      "new_path": "mm/hugetlb.c"
    }
  ]
}