userfaultfd: shmem: lock the page before adding it to pagecache

A VM_BUG_ON triggered on the shmem selftest.

Link: http://lkml.kernel.org/r/20161216144821.5183-36-aarcange@redhat.com
Signed-off-by: Andrea Arcangeli <aarcange@redhat.com>
Cc: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
Cc: Hillf Danton <hillf.zj@alibaba-inc.com>
Cc: Michael Rapoport <RAPOPORT@il.ibm.com>
Cc: Mike Kravetz <mike.kravetz@oracle.com>
Cc: Mike Rapoport <rppt@linux.vnet.ibm.com>
Cc: Pavel Emelyanov <xemul@parallels.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

diff --git a/mm/shmem.c b/mm/shmem.c
index ab6644194fee8f5229af4553590d56c104409b15..4e5e7a57e5b4ee809029e9b4d7968b9dae3bf909 100644 (file)
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -2245,6 +2245,10 @@ int shmem_mcopy_atomic_pte(struct mm_struct *dst_mm,
                *pagep = NULL;
        }
 
+       VM_BUG_ON(PageLocked(page) || PageSwapBacked(page));
+       __SetPageLocked(page);
+       __SetPageSwapBacked(page);
+
        ret = mem_cgroup_try_charge(page, dst_mm, gfp, &memcg, false);
        if (ret)
                goto out_release;
@@ -2294,6 +2298,7 @@ out_release_uncharge_unlock:
 out_release_uncharge:
        mem_cgroup_cancel_charge(page, memcg, false);
 out_release:
+       unlock_page(page);
        put_page(page);
 out_dec_used_blocks:
        if (sbinfo->max_blocks)