[PATCH] futex: bugfix for futex-key conflict when futex use hugepage

[jiang.biao2@xxxxxxxxxx]

From: Zhang Yi <zhang.yi20@xxxxxxxxxx>

The futex-keys of processes share futex
determined by page-offset, mapping-host, and 
mapping-index of the user space address.
User appications using hugepage for
futex may lead to futex-key conflict. Assume there 
are two or more futexes in diffrent
normal pages of the hugepage, and each futex has 
the same offset in its normal page,
causing all the futexes have the same futex-key. 
In that case, futex may not work well.

This patch adds the normal page index
in the compound page into the offset of futex-key.

Steps to reproduce the bug:
1. The 1st thread map a file of hugetlbfs,
and use the return address as the 1st mutex's 
address, and use the return address
with PAGE_SIZE added as the 2nd mutex's address;
2. The 1st thread initialize the two
mutexes with pshared attribute, and lock the two mutexes.
3. The 1st thread create the 2nd thread,
and the 2nd thread block on the 1st mutex.
4. The 1st thread create the 3rd thread,
and the 3rd thread block on the 2nd mutex.
5. The 1st thread unlock the 2nd mutex,
the 3rd thread can not take the 2nd mutex, and 
may block forever.

Signed-off-by: Zhang Yi <zhang.yi20@xxxxxxxxxx>
Tested-by: Ma Chenggong <ma.chenggong@xxxxxxxxxx>
Reviewed-by: Liu Dong <liu.dong3@xxxxxxxxxx>
Reviewed-by: Cui Yunfeng <cui.yunfeng@xxxxxxxxxx>
Reviewed-by: Lu Zhongjun <lu.zhongjun@xxxxxxxxxx>
Reviewed-by: Jiang Biao <jiang.biao2@xxxxxxxxxx>

diff -uprN orig/linux-3.9-rc5/include/linux/mm.h
new/linux-3.9-rc5/include/linux/mm.h
--- orig/linux-3.9-rc5/include/linux/mm.h
       2013-03-31 22:12:43.000000000 +0000
+++ new/linux-3.9-rc5/include/linux/mm.h
       2013-04-03 11:01:19.671403000 +0000
@@ -502,6 +502,20 @@ static inline void
set_compound_order(st
         page[1].lru.prev
= (void *)order;
 }
 
+static inline void set_page_compound_index(struct
page *page, int index)
+{
+        if
(PageHead(page))
+        
       return;
+        page->index
= index;
+}
+
+static inline int get_page_compound_index(struct
page *page)
+{
+        if
(PageHead(page))
+        
       return 0;
+        return
page->index;
+}
+
 #ifdef CONFIG_MMU
 /*
  * Do pte_mkwrite, but only if
the vma says VM_WRITE.  We do this when
diff -uprN orig/linux-3.9-rc5/kernel/futex.c
new/linux-3.9-rc5/kernel/futex.c
--- orig/linux-3.9-rc5/kernel/futex.c
       2013-03-31 22:12:43.000000000 +0000
+++ new/linux-3.9-rc5/kernel/futex.c
       2013-04-03 11:03:42.168663000 +0000
@@ -239,7 +239,7 @@ get_futex_key(u32
__user *uaddr, int fsh
         unsigned
long address = (unsigned long)uaddr;
         struct
mm_struct *mm = current->mm;
         struct
page *page, *page_head;
-        int
err, ro = 0;
+        int
err, ro = 0, compound_index = 0;
 
         /*
         
* The futex address must be "naturally" aligned.
@@ -299,6 +299,7 @@ again:
         
               
* freed from under us.
         
               
*/
         
               if
(page != page_head) {
+        
               
       compound_index = get_page_compound_index(page);
         
               
       get_page(page_head);
         
               
       put_page(page);
         
               }
@@ -311,6 +312,7 @@ again:
 #else
         page_head
= compound_head(page);
         if
(page != page_head) {
+        
       compound_index = get_page_compound_index(page);
         
       get_page(page_head);
         
       put_page(page);
         }
@@ -363,7 +365,7 @@ again:
         
       key->private.mm = mm;
         
       key->private.address = address;
         }
else {
-        
       key->both.offset |= FUT_OFF_INODE;
/* inode-based key */
+        
       key->both.offset |= (compound_index
<< PAGE_SHIFT) | FUT_OFF_INODE; /* inode-based key */
         
       key->shared.inode = page_head->mapping->host;
         
       key->shared.pgoff = page_head->index;
         }
diff -uprN orig/linux-3.9-rc5/mm/hugetlb.c
new/linux-3.9-rc5/mm/hugetlb.c
--- orig/linux-3.9-rc5/mm/hugetlb.c
       2013-03-31 22:12:43.000000000 +0000
+++ new/linux-3.9-rc5/mm/hugetlb.c  
     2013-04-03 11:02:10.556132000 +0000
@@ -667,6 +667,7 @@ static void prep_compound_gigantic_page(
         for
(i = 1; i < nr_pages; i++, p = mem_map_next(p, page, i)) {
         
       __SetPageTail(p);
         
       set_page_count(p, 0);
+        
       set_page_compound_index(p, i);
         
       p->first_page = page;
         }
 }
diff -uprN orig/linux-3.9-rc5/mm/page_alloc.c
new/linux-3.9-rc5/mm/page_alloc.c
--- orig/linux-3.9-rc5/mm/page_alloc.c
       2013-03-31 22:12:43.000000000 +0000
+++ new/linux-3.9-rc5/mm/page_alloc.c
       2013-04-03 11:01:47.933353000 +0000
@@ -361,6 +361,7 @@ void prep_compound_page(struct
page *pag
         
       struct page *p = page + i;
         
       __SetPageTail(p);
         
       set_page_count(p, 0);
+        
       set_page_compound_index(p, i);
         
       p->first_page = page;
         }
 }

--------------------------------------------------------
ZTE Information Security Notice: The information contained in this mail (and any attachment transmitted herewith) is privileged and confidential and is intended for the exclusive use of the addressee(s).  If you are not an intended recipient, any disclosure, reproduction, distribution or other dissemination or use of the information contained is strictly prohibited.  If you have received this mail in error, please delete it and notify us immediately.