[PATCH mm/filemap_xip.c] Fix race condition in xip_file_fault

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Reported-by: David Sadler <dsadler@xxxxxxxxxx>

This patch fixes a race condition that shows in conjunction with xip_file_fault when two threads of the same user process fault on the same memory page. In this case, the race winner will install the page table entry, and the unlucky loser
will cause an oops:
xip_file_fault calls vm_insert_pfn (via vm_insert_mixed) which drops out at
this check:
	retval = -EBUSY;
	if (!pte_none(*pte))
		goto out_unlock;
The resulting -EBUSY return value will trigger a BUG_ON() in xip_file_fault.

This fix simply considers the fault as fixed in this case, because the
race winner has successfully installed the pte.

Signed-off-by: Carsten Otte <cotte@xxxxxxxxxx>
---
 mm/filemap_xip.c |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

--- a/mm/filemap_xip.c
+++ b/mm/filemap_xip.c
@@ -263,7 +263,10 @@ found:
 							xip_pfn);
 		if (err == -ENOMEM)
 			return VM_FAULT_OOM;
-		BUG_ON(err);
+		/* err == -EBUSY is fine, we've raced against another thread
+		   that faulted-in the same page */
+		if (err != -EBUSY)
+			BUG_ON(err);
 		return VM_FAULT_NOPAGE;
 	} else {
 		int err, ret = VM_FAULT_OOM;
--
To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html


[Index of Archives]     [Linux Ext4 Filesystem]     [Union Filesystem]     [Filesystem Testing]     [Ceph Users]     [Ecryptfs]     [AutoFS]     [Kernel Newbies]     [Share Photos]     [Security]     [Netfilter]     [Bugtraq]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux Cachefs]     [Reiser Filesystem]     [Linux RAID]     [Samba]     [Device Mapper]     [CEPH Development]
  Powered by Linux