mm: tiny-shmem fix lock ordering: mmap_sem vs i_mutex

tiny-shmem calls do_truncate in shmem_file_setup.  do_truncate takes
i_mutex, and shmem_file_setup is called with mmap_sem held.  However
i_mutex nests outside mmap_sem.

Copy the code in shmem.c to avoid this problem.

[akpm@linux-foundation.org: coding-style fixes]
Signed-off-by: Nick Piggin <npiggin@suse.de>
Reported-and-tested-by: Ingo Molnar <mingo@elte.hu>
Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: Matt Mackall <mpm@selenic.com>
Cc: Hugh Dickins <hugh@veritas.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

diff --git a/mm/tiny-shmem.c b/mm/tiny-shmem.c
index ae532f50194319ce83b813a88b6a25aa5a4e85e5..d17cb6f6ab1029cdad5ef6a67523be159ff12211 100644 (file)
--- a/mm/tiny-shmem.c
+++ b/mm/tiny-shmem.c
@@ -65,31 +65,25 @@ struct file *shmem_file_setup(char *name, loff_t size, unsigned long flags)
        if (!dentry)
                goto put_memory;
 
-       error = -ENOSPC;
-       inode = ramfs_get_inode(root->d_sb, S_IFREG | S_IRWXUGO, 0);
-       if (!inode)
-               goto put_dentry;
-
-       d_instantiate(dentry, inode);
        error = -ENFILE;
-       file = alloc_file(shm_mnt, dentry, FMODE_WRITE | FMODE_READ,
-                       &ramfs_file_operations);
+       file = get_empty_filp();
        if (!file)
                goto put_dentry;
 
-       inode->i_nlink = 0;     /* It is unlinked */
-
-       /* notify everyone as to the change of file size */
-       error = do_truncate(dentry, size, 0, file);
-       if (error < 0)
+       error = -ENOSPC;
+       inode = ramfs_get_inode(root->d_sb, S_IFREG | S_IRWXUGO, 0);
+       if (!inode)
                goto close_file;
 
+       d_instantiate(dentry, inode);
+       inode->i_size = size;
+       inode->i_nlink = 0;     /* It is unlinked */
+       init_file(file, shm_mnt, dentry, FMODE_WRITE | FMODE_READ,
+                       &ramfs_file_operations);
        return file;
 
 close_file:
        put_filp(file);
-       return ERR_PTR(error);
-
 put_dentry:
        dput(dentry);
 put_memory: