mirror of https://gitee.com/openkylin/linux.git
futex: Fix uninterruptible loop due to gate_area
It was found (by Sasha) that if you use a futex located in the gate area we get stuck in an uninterruptible infinite loop, much like the ZERO_PAGE issue. While looking at this problem, PeterZ realized you'll get into similar trouble when hitting any install_special_pages() mapping. And are there still drivers setting up their own special mmaps without page->mapping, and without special VM or pte flags to make get_user_pages fail? In most cases, if page->mapping is NULL, we do not need to retry at all: Linus points out that even /proc/sys/vm/drop_caches poses no problem, because it ends up using remove_mapping(), which takes care not to interfere when the page reference count is raised. But there is still one case which does need a retry: if memory pressure called shmem_writepage in between get_user_pages_fast dropping page table lock and our acquiring page lock, then the page gets switched from filecache to swapcache (and ->mapping set to NULL) whatever the refcount. Fault it back in to get the page->mapping needed for key->shared.inode. Reported-by: Sasha Levin <levinsasha928@gmail.com> Signed-off-by: Hugh Dickins <hughd@google.com> Cc: stable@vger.kernel.org Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This commit is contained in:
parent
06867fbb8a
commit
e6780f7243
|
@ -314,17 +314,29 @@ get_futex_key(u32 __user *uaddr, int fshared, union futex_key *key, int rw)
|
||||||
#endif
|
#endif
|
||||||
|
|
||||||
lock_page(page_head);
|
lock_page(page_head);
|
||||||
|
|
||||||
|
/*
|
||||||
|
* If page_head->mapping is NULL, then it cannot be a PageAnon
|
||||||
|
* page; but it might be the ZERO_PAGE or in the gate area or
|
||||||
|
* in a special mapping (all cases which we are happy to fail);
|
||||||
|
* or it may have been a good file page when get_user_pages_fast
|
||||||
|
* found it, but truncated or holepunched or subjected to
|
||||||
|
* invalidate_complete_page2 before we got the page lock (also
|
||||||
|
* cases which we are happy to fail). And we hold a reference,
|
||||||
|
* so refcount care in invalidate_complete_page's remove_mapping
|
||||||
|
* prevents drop_caches from setting mapping to NULL beneath us.
|
||||||
|
*
|
||||||
|
* The case we do have to guard against is when memory pressure made
|
||||||
|
* shmem_writepage move it from filecache to swapcache beneath us:
|
||||||
|
* an unlikely race, but we do need to retry for page_head->mapping.
|
||||||
|
*/
|
||||||
if (!page_head->mapping) {
|
if (!page_head->mapping) {
|
||||||
|
int shmem_swizzled = PageSwapCache(page_head);
|
||||||
unlock_page(page_head);
|
unlock_page(page_head);
|
||||||
put_page(page_head);
|
put_page(page_head);
|
||||||
/*
|
if (shmem_swizzled)
|
||||||
* ZERO_PAGE pages don't have a mapping. Avoid a busy loop
|
goto again;
|
||||||
* trying to find one. RW mapping would have COW'd (and thus
|
return -EFAULT;
|
||||||
* have a mapping) so this page is RO and won't ever change.
|
|
||||||
*/
|
|
||||||
if ((page_head == ZERO_PAGE(address)))
|
|
||||||
return -EFAULT;
|
|
||||||
goto again;
|
|
||||||
}
|
}
|
||||||
|
|
||||||
/*
|
/*
|
||||||
|
|
Loading…
Reference in New Issue