tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

mm: dirty page tracking race fix

There is a race with dirty page accounting where a page may not properly
be accounted for.

clear_page_dirty_for_io() calls page_mkclean; then TestClearPageDirty.

page_mkclean walks the rmaps for that page, and for each one it cleans and
write protects the pte if it was dirty. It uses page_check_address to
find the pte. That function has a shortcut to avoid the ptl if the pte is
not present. Unfortunately, the pte can be switched to not-present then
back to present by other code while holding the page table lock -- this
should not be a signal for page_mkclean to ignore that pte, because it may
be dirty.

For example, powerpc64's set_pte_at will clear a previously present pte
before setting it to the desired value. There may also be other code in
core mm or in arch which do similar things.

The consequence of the bug is loss of data integrity due to msync, and
loss of dirty page accounting accuracy. XIP's __xip_unmap could easily
also be unreliable (depending on the exact XIP locking scheme), which can
lead to data corruption.

Fix this by having an option to always take ptl to check the pte in
page_check_address.

It's possible to retain this optimization for page_referenced and
try_to_unmap.

Signed-off-by: Nick Piggin <npiggin@suse.de>
Cc: Jared Hulbert <jaredeh@gmail.com>
Cc: Carsten Otte <cotte@freenet.de>
Cc: Hugh Dickins <hugh@veritas.com>
Acked-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

authored by

Nick Piggin and committed by
Linus Torvalds 479db0bf 2d70b68d

+11 -7
+1 -1
include/linux/rmap.h
··· 102 102 * Called from mm/filemap_xip.c to unmap empty zero page 103 103 */ 104 104 pte_t *page_check_address(struct page *, struct mm_struct *, 105 - unsigned long, spinlock_t **); 105 + unsigned long, spinlock_t **, int); 106 106 107 107 /* 108 108 * Used by swapoff to help locate where page is expected in vma.
+1 -1
mm/filemap_xip.c
··· 185 185 address = vma->vm_start + 186 186 ((pgoff - vma->vm_pgoff) << PAGE_SHIFT); 187 187 BUG_ON(address < vma->vm_start || address >= vma->vm_end); 188 - pte = page_check_address(page, mm, address, &ptl); 188 + pte = page_check_address(page, mm, address, &ptl, 1); 189 189 if (pte) { 190 190 /* Nuke the page table entry. */ 191 191 flush_cache_page(vma, address, pte_pfn(*pte));
+9 -5
mm/rmap.c
··· 224 224 /* 225 225 * Check that @page is mapped at @address into @mm. 226 226 * 227 + * If @sync is false, page_check_address may perform a racy check to avoid 228 + * the page table lock when the pte is not present (helpful when reclaiming 229 + * highly shared pages). 230 + * 227 231 * On success returns with pte mapped and locked. 228 232 */ 229 233 pte_t *page_check_address(struct page *page, struct mm_struct *mm, 230 - unsigned long address, spinlock_t **ptlp) 234 + unsigned long address, spinlock_t **ptlp, int sync) 231 235 { 232 236 pgd_t *pgd; 233 237 pud_t *pud; ··· 253 249 254 250 pte = pte_offset_map(pmd, address); 255 251 /* Make a quick check before getting the lock */ 256 - if (!pte_present(*pte)) { 252 + if (!sync && !pte_present(*pte)) { 257 253 pte_unmap(pte); 258 254 return NULL; 259 255 } ··· 285 281 if (address == -EFAULT) 286 282 goto out; 287 283 288 - pte = page_check_address(page, mm, address, &ptl); 284 + pte = page_check_address(page, mm, address, &ptl, 0); 289 285 if (!pte) 290 286 goto out; 291 287 ··· 454 450 if (address == -EFAULT) 455 451 goto out; 456 452 457 - pte = page_check_address(page, mm, address, &ptl); 453 + pte = page_check_address(page, mm, address, &ptl, 1); 458 454 if (!pte) 459 455 goto out; 460 456 ··· 708 704 if (address == -EFAULT) 709 705 goto out; 710 706 711 - pte = page_check_address(page, mm, address, &ptl); 707 + pte = page_check_address(page, mm, address, &ptl, 0); 712 708 if (!pte) 713 709 goto out; 714 710