mm, hugetlb: fix race in region tracking

There is a race condition if we map a same file on different processes.
Region tracking is protected by mmap_sem and hugetlb_instantiation_mutex.
When we do mmap, we don't grab a hugetlb_instantiation_mutex, but only
mmap_sem (exclusively).  This doesn't prevent other tasks from modifying
the region structure, so it can be modified by two processes
concurrently.

To solve this, introduce a spinlock to resv_map and make region
manipulation function grab it before they do actual work.

[[email protected]: updated changelog]
Signed-off-by: Davidlohr Bueso <[email protected]>
Signed-off-by: Joonsoo Kim <[email protected]>
Suggested-by: Joonsoo Kim <[email protected]>
Acked-by: David Gibson <[email protected]>
Cc: David Gibson <[email protected]>
Cc: Naoya Horiguchi <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>

1 files changed, 1 insertions, 0 deletions

diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h
index f62c2f6c6059..5b337cf8fb86 100644
--- a/include/linux/hugetlb.h
+++ b/include/linux/hugetlb.h
@@ -27,6 +27,7 @@ struct hugepage_subpool {
 
 struct resv_map {
 	struct kref refs;
+	spinlock_t lock;
 	struct list_head regions;
 };
 extern struct resv_map *resv_map_alloc(void);