linux-mm.kvack.org archive mirror
 help / color / mirror / Atom feed
* [PATCH] hugetlb: fix race condition in hugetlb_fault()
@ 2012-03-30 20:07 Chris Metcalf
  2012-03-31 12:27 ` Hillf Danton
  0 siblings, 1 reply; 17+ messages in thread
From: Chris Metcalf @ 2012-03-30 20:07 UTC (permalink / raw)
  To: linux-kernel, linux-mm, Andrew Morton, Michal Hocko, Hillf Danton,
	KAMEZAWA Hiroyuki, Hugh Dickins

The race is as follows.  Suppose a multi-threaded task forks a new
process, thus bumping up the ref count on all the pages.  While the fork
is occurring (and thus we have marked all the PTEs as read-only), another
thread in the original process tries to write to a huge page, taking an
access violation from the write-protect and calling hugetlb_cow().  Now,
suppose the fork() fails.  It will undo the COW and decrement the ref
count on the pages, so the ref count on the huge page drops back to 1.
Meanwhile hugetlb_cow() also decrements the ref count by one on the
original page, since the original address space doesn't need it any more,
having copied a new page to replace the original page.  This leaves the
ref count at zero, and when we call unlock_page(), we panic.

The solution is to take an extra reference to the page while we are
holding the lock on it.

Cc: stable@kernel.org
Signed-off-by: Chris Metcalf <cmetcalf@tilera.com>
---
 mm/hugetlb.c |    8 ++++++--
 1 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 4531be2..ab674fc 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -2703,8 +2703,10 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
 	 * so no worry about deadlock.
 	 */
 	page = pte_page(entry);
-	if (page != pagecache_page)
+	if (page != pagecache_page) {
+		get_page(page);
 		lock_page(page);
+	}
 
 	spin_lock(&mm->page_table_lock);
 	/* Check for a racing update before calling hugetlb_cow */
@@ -2732,8 +2734,10 @@ out_page_table_lock:
 		unlock_page(pagecache_page);
 		put_page(pagecache_page);
 	}
-	if (page != pagecache_page)
+	if (page != pagecache_page) {
 		unlock_page(page);
+		put_page(page);
+	}
 
 out_mutex:
 	mutex_unlock(&hugetlb_instantiation_mutex);
-- 
1.6.5.2

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Fight unfair telecom internet charges in Canada: sign http://stopthemeter.ca/
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>

^ permalink raw reply related	[flat|nested] 17+ messages in thread

end of thread, other threads:[~2012-04-07  0:25 UTC | newest]

Thread overview: 17+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2012-03-30 20:07 [PATCH] hugetlb: fix race condition in hugetlb_fault() Chris Metcalf
2012-03-31 12:27 ` Hillf Danton
2012-03-30 19:37   ` [PATCH v2] arch/tile: support multiple huge page sizes dynamically Chris Metcalf
2012-03-31 14:03     ` Hillf Danton
2012-03-30 19:37       ` [PATCH v3] " Chris Metcalf
2012-04-01 12:33         ` Hillf Danton
2012-04-01 16:46           ` Chris Metcalf
2012-04-02  2:21             ` Hillf Danton
2012-03-30 20:07   ` [PATCH v2] hugetlb: fix race condition in hugetlb_fault() Chris Metcalf
2012-04-01 12:10     ` Hillf Danton
2012-04-01 16:51       ` Chris Metcalf
2012-03-30 20:07         ` [PATCH v3] " Chris Metcalf
2012-04-06 22:23         ` [PATCH v2] " Andrew Morton
2012-04-06 23:10           ` Hugh Dickins
2012-04-06 23:26             ` Andrew Morton
2012-04-06 23:35               ` Hugh Dickins
2012-04-07  0:25                 ` Chris Metcalf

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).