The patch titled
Subject: mm/filemap_xip.c: fix race condition in xip_file_fault()
has been added to the -mm tree. Its filename is
mm-filemap_xipc-fix-race-condition-in-xip_file_fault.patch
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/SubmitChecklist when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Carsten Otte <carsteno@xxxxxxxxxx>
Subject: mm/filemap_xip.c: fix race condition in xip_file_fault()
Fix a race condition that shows in conjunction with xip_file_fault() when
two threads of the same user process fault on the same memory page.
In this case, the race winner will install the page table entry and the
unlucky loser will cause an oops: xip_file_fault calls vm_insert_pfn (via
vm_insert_mixed) which drops out at this check:
retval = -EBUSY;
if (!pte_none(*pte))
goto out_unlock;
The resulting -EBUSY return value will trigger a BUG_ON() in
xip_file_fault.
This fix simply considers the fault as fixed in this case, because the
race winner has successfully installed the pte.
Reported-by: David Sadler <dsadler@xxxxxxxxxx>
Signed-off-by: Carsten Otte <cotte@xxxxxxxxxx>
Reported-by: Louis Alex Eisner <leisner@xxxxxxxxxxx>
Cc: Hugh Dickins <hughd@xxxxxxxxxx>
Cc: <stable@xxxxxxxxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---
mm/filemap_xip.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff -puN mm/filemap_xip.c~mm-filemap_xipc-fix-race-condition-in-xip_file_fault mm/filemap_xip.c
--- a/mm/filemap_xip.c~mm-filemap_xipc-fix-race-condition-in-xip_file_fault
+++ a/mm/filemap_xip.c
@@ -263,7 +263,10 @@ found:
xip_pfn);
if (err == -ENOMEM)
return VM_FAULT_OOM;
- BUG_ON(err);
+ /* err == -EBUSY is fine, we've raced against another thread
+ that faulted-in the same page */
+ if (err != -EBUSY)
+ BUG_ON(err);
return VM_FAULT_NOPAGE;
} else {
int err, ret = VM_FAULT_OOM;
_
Subject: Subject: mm/filemap_xip.c: fix race condition in xip_file_fault()
Patches currently in -mm which might be from carsteno@xxxxxxxxxx are
mm-filemap_xipc-fix-race-condition-in-xip_file_fault.patch
mm-filemap_xipc-fix-race-condition-in-xip_file_fault-fix.patch
--
To unsubscribe from this list: send the line "unsubscribe mm-commits" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
