summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMiklos Szeredi <mszeredi@redhat.com>2020-05-19 14:50:37 +0200
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2020-10-01 20:40:13 +0200
commit3a9677b791bb866bef538ebeb8d77d76adac536d (patch)
tree3a1c4dc804b46027228996f946fd8a51d78c2d4b
parent70109a8b5f8a57ac84b9c295187abecc30a2dc33 (diff)
downloadlinux-stable-3a9677b791bb866bef538ebeb8d77d76adac536d.tar.gz
linux-stable-3a9677b791bb866bef538ebeb8d77d76adac536d.tar.bz2
linux-stable-3a9677b791bb866bef538ebeb8d77d76adac536d.zip
fuse: don't check refcount after stealing page
[ Upstream commit 32f98877c57bee6bc27f443a96f49678a2cd6a50 ] page_count() is unstable. Unless there has been an RCU grace period between when the page was removed from the page cache and now, a speculative reference may exist from the page cache. Reported-by: Matthew Wilcox <willy@infradead.org> Signed-off-by: Miklos Szeredi <mszeredi@redhat.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
-rw-r--r--fs/fuse/dev.c1
1 files changed, 0 insertions, 1 deletions
diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
index b99225e11712..f0129c033bd6 100644
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -825,7 +825,6 @@ static int fuse_check_page(struct page *page)
{
if (page_mapcount(page) ||
page->mapping != NULL ||
- page_count(page) != 1 ||
(page->flags & PAGE_FLAGS_CHECK_AT_PREP &
~(1 << PG_locked |
1 << PG_referenced |