Re: [PATCH 3/3] flush_tlb_range() needs ->page_table_lock when ->mmap_sem is not held

[Al Viro <viro@ZenIV.linux.org.uk>]

On Mon, Mar 05, 2012 at 12:30:19PM -0800, Linus Torvalds wrote:
> Is this safe? And why does it need it? Please add more explanations.

a) safety - as the matter of fact, all other callers either hold either
->mmap_sem (exclusive) or ->page_table_lock.  flush_tlb_range() is
called under ->page_table_lock in a lot of places, e.g.
page_referenced_one() -> pmdp_clear_flush_young_notify() ->
-> pmdp_clear_flush_young() -> flush_tlb_range(), with
                /* go ahead even if the pmd is pmd_trans_splitting() */
                if (pmdp_clear_flush_young_notify(vma, address, pmd))
                        referenced++;
                spin_unlock(&mm->page_table_lock);
in page_referenced_one().

b) there are instances that work with page tables.  See e.g.
arch/powerpc/mm/tlb_hash32.c, flush_tlb_range() and flush_range() in there.
The same goes for uml, with a lot more extensive playing with page tables.

Almost all callers are actually fine - flush_tlb_range() may have no need
to bother playing with page tables, but it can do so safely; again, this
caller is the sole exception - everything else either has exclusive ->mmap_sem
on the mm in question, or mm->page_table_lock is held.