Doug / smarc-fsl-linux-kernel

Download as
Browse Code ยป

Commit f18194275c39835cb84563500995e0d503a32d9a

Authored by Hugh Dickins
Committed by Linus Torvalds
1 parent d4348c6789
Exists in master and in 7 other branches imx_3.0.35_4.1.0, imx_3.10.17_1.0.1_ga, imx_3.10.53_1.1.0_ga, imx_3.14.28_1.0.0_ga, smarc-imx_3.10.53_1.1.0_ga, smarc-imx_3.14.28_1.0.0_ga, smarc-l5.0.0_1.0.0-ga

mm: fix hang on anon_vma->root->lock 

After several hours, kbuild tests hang with anon_vma_prepare() spinning on
a newly allocated anon_vma's lock - on a box with CONFIG_TREE_PREEMPT_RCU=y
(which makes this very much more likely, but it could happen without).

The ever-subtle page_lock_anon_vma() now needs a further twist: since
anon_vma_prepare() and anon_vma_fork() are liable to change the ->root
of a reused anon_vma structure at any moment, page_lock_anon_vma()
needs to check page_mapped() again before succeeding, otherwise
page_unlock_anon_vma() might address a different root->lock.

Signed-off-by: Hugh Dickins <hughd@google.com>
Reviewed-by: Rik van Riel <riel@redhat.com>
Cc: Christoph Lameter <cl@linux.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Showing 1 changed file with 16 additions and 3 deletions Side-by-side Diff

... ... @@ -316,7 +316,7 @@
316 316 */
317 317 struct anon_vma *page_lock_anon_vma(struct page *page)
318 318 {
319   - struct anon_vma *anon_vma;
  319 + struct anon_vma *anon_vma, *root_anon_vma;
320 320 unsigned long anon_mapping;
321 321  
322 322 rcu_read_lock();
... ... @@ -327,8 +327,21 @@
327 327 goto out;
328 328  
329 329 anon_vma = (struct anon_vma *) (anon_mapping - PAGE_MAPPING_ANON);
330   - anon_vma_lock(anon_vma);
331   - return anon_vma;
  330 + root_anon_vma = ACCESS_ONCE(anon_vma->root);
  331 + spin_lock(&root_anon_vma->lock);
  332 +
  333 + /*
  334 + * If this page is still mapped, then its anon_vma cannot have been
  335 + * freed. But if it has been unmapped, we have no security against
  336 + * the anon_vma structure being freed and reused (for another anon_vma:
  337 + * SLAB_DESTROY_BY_RCU guarantees that - so the spin_lock above cannot
  338 + * corrupt): with anon_vma_prepare() or anon_vma_fork() redirecting
  339 + * anon_vma->root before page_unlock_anon_vma() is called to unlock.
  340 + */
  341 + if (page_mapped(page))
  342 + return anon_vma;
  343 +
  344 + spin_unlock(&root_anon_vma->lock);
332 345 out:
333 346 rcu_read_unlock();
334 347 return NULL;