On Sat, Feb 07, 2009 at 03:32:03PM +0200, Izik Eidus wrote: > we are opening here a tiny race: > > cpu#1 do get_user_pages_fast and fetch the pte (it think the pte is > writeable) > cpu#2 do ptep_set_wrprotect() > cpu#2 check the mapcount against pagecount (it think that everything is > fine and continue) > cpu#1 only now do get_page() > > Anyway this is minor issue that can be probably solved by just: > rechecking if the pte isnt read_only in gup_fast after we do the get_page() Not needed, if I check page_count vs mapcount after marking the pte readonly and after sending smp-tlb-flush there is no race. > Anyway sound like a great idea to fix this issue! The only problem I'm thinking now is the IPI flood that would be generated if I send IPIs for every pte wrprotected in fork, that sounds overkill. So to use the IPI fix I could have gup-fast take the slow path first time around if PG_gup isn't set, and then only second time take the lockless fast path when PG_gup is already set (PG_gup gets set by follow_page under PT lock/mmap_sem read mode at least). And fork/ksm would only send IPIs for PG_gup pages. However that would make gup-fast slow the first time it runs on an anonymous/hugetlb page with pte marked writeable and I'm unsure if that's ok. Otherwise we've to return to the plan of the slightly more complicated fix. -- To unsubscribe from this list: send the line "unsubscribe linux-man" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
