This patch addresses issues with page fault/truncation synchronization. The first issue was noticed as a negative hugetlb reserved page counts during DB development testing. Code inspection revealed that the most likely cause were races with truncate and page faults. In fact, I could write a not too complicated program to cause the races and recreate the issue. A more dangerous issue exists when you introduce huge pmd sharing to page fault/truncate races. The fist thing that happens in huge page fault processing is a call to huge_pte_alloc to get a ptep. Suppose that ptep points to a shared pmd. Now, another thread could perform a truncate and unmap everyone mapping the file. huge_pmd_unshare can be called for the mapping on which the first thread is operating. huge_pmd_unshare can clear pud pointing to the pmd. After this, the ptep points to another task's page table or worse. This leads to bad things such as incorrect page map/reference counts or invaid memory references. Fix this all by modifying the usage of i_mmap_rwsem to cover fault/truncate races as well as handling of shared pmds Mike Kravetz (1): hugetlbfs: use i_mmap_rwsem for pmd sharing and truncate/fault sync fs/hugetlbfs/inode.c | 21 ++++++++++---- mm/hugetlb.c | 65 +++++++++++++++++++++++++++++++++----------- mm/rmap.c | 10 +++++++ mm/userfaultfd.c | 11 ++++++-- 4 files changed, 84 insertions(+), 23 deletions(-) -- 2.17.2
