rpms/kernel/F-9 linux-2.6-mm-dirty-page-tracking-race-fix.patch, NONE, 1.1 kernel.spec, 1.752, 1.753
Chuck Ebbert
cebbert at fedoraproject.org
Sun Aug 31 01:48:57 UTC 2008
Author: cebbert
Update of /cvs/pkgs/rpms/kernel/F-9
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv12447
Modified Files:
kernel.spec
Added Files:
linux-2.6-mm-dirty-page-tracking-race-fix.patch
Log Message:
mm: dirty page tracking race fix
linux-2.6-mm-dirty-page-tracking-race-fix.patch:
--- NEW FILE linux-2.6-mm-dirty-page-tracking-race-fix.patch ---
From: Nick Piggin <npiggin at suse.de>
Date: Wed, 20 Aug 2008 21:09:18 +0000 (-0700)
Subject: mm: dirty page tracking race fix
X-Git-Tag: v2.6.27-rc4~6
X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commitdiff_plain;h=479db0bf408e65baa14d2a9821abfcbc0804b847
mm: dirty page tracking race fix
There is a race with dirty page accounting where a page may not properly
be accounted for.
clear_page_dirty_for_io() calls page_mkclean; then TestClearPageDirty.
page_mkclean walks the rmaps for that page, and for each one it cleans and
write protects the pte if it was dirty. It uses page_check_address to
find the pte. That function has a shortcut to avoid the ptl if the pte is
not present. Unfortunately, the pte can be switched to not-present then
back to present by other code while holding the page table lock -- this
should not be a signal for page_mkclean to ignore that pte, because it may
be dirty.
For example, powerpc64's set_pte_at will clear a previously present pte
before setting it to the desired value. There may also be other code in
core mm or in arch which do similar things.
The consequence of the bug is loss of data integrity due to msync, and
loss of dirty page accounting accuracy. XIP's __xip_unmap could easily
also be unreliable (depending on the exact XIP locking scheme), which can
lead to data corruption.
Fix this by having an option to always take ptl to check the pte in
page_check_address.
It's possible to retain this optimization for page_referenced and
try_to_unmap.
Signed-off-by: Nick Piggin <npiggin at suse.de>
Cc: Jared Hulbert <jaredeh at gmail.com>
Cc: Carsten Otte <cotte at freenet.de>
Cc: Hugh Dickins <hugh at veritas.com>
Acked-by: Peter Zijlstra <a.p.zijlstra at chello.nl>
Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
---
diff --git a/include/linux/rmap.h b/include/linux/rmap.h
index 69407f8..fed6f5e 100644
--- a/include/linux/rmap.h
+++ b/include/linux/rmap.h
@@ -102,7 +102,7 @@ int try_to_unmap(struct page *, int ignore_refs);
* Called from mm/filemap_xip.c to unmap empty zero page
*/
pte_t *page_check_address(struct page *, struct mm_struct *,
- unsigned long, spinlock_t **);
+ unsigned long, spinlock_t **, int);
/*
* Used by swapoff to help locate where page is expected in vma.
diff --git a/mm/filemap_xip.c b/mm/filemap_xip.c
index 380ab40..8b710ca 100644
--- a/mm/filemap_xip.c
+++ b/mm/filemap_xip.c
@@ -185,7 +185,7 @@ __xip_unmap (struct address_space * mapping,
address = vma->vm_start +
((pgoff - vma->vm_pgoff) << PAGE_SHIFT);
BUG_ON(address < vma->vm_start || address >= vma->vm_end);
- pte = page_check_address(page, mm, address, &ptl);
+ pte = page_check_address(page, mm, address, &ptl, 1);
if (pte) {
/* Nuke the page table entry. */
flush_cache_page(vma, address, pte_pfn(*pte));
diff --git a/mm/rmap.c b/mm/rmap.c
index 0597747..0383acf 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -224,10 +224,14 @@ unsigned long page_address_in_vma(struct page *page, struct vm_area_struct *vma)
/*
* Check that @page is mapped at @address into @mm.
*
+ * If @sync is false, page_check_address may perform a racy check to avoid
+ * the page table lock when the pte is not present (helpful when reclaiming
+ * highly shared pages).
+ *
* On success returns with pte mapped and locked.
*/
pte_t *page_check_address(struct page *page, struct mm_struct *mm,
- unsigned long address, spinlock_t **ptlp)
+ unsigned long address, spinlock_t **ptlp, int sync)
{
pgd_t *pgd;
pud_t *pud;
@@ -249,7 +253,7 @@ pte_t *page_check_address(struct page *page, struct mm_struct *mm,
pte = pte_offset_map(pmd, address);
/* Make a quick check before getting the lock */
- if (!pte_present(*pte)) {
+ if (!sync && !pte_present(*pte)) {
pte_unmap(pte);
return NULL;
}
@@ -281,7 +285,7 @@ static int page_referenced_one(struct page *page,
if (address == -EFAULT)
goto out;
- pte = page_check_address(page, mm, address, &ptl);
+ pte = page_check_address(page, mm, address, &ptl, 0);
if (!pte)
goto out;
@@ -450,7 +454,7 @@ static int page_mkclean_one(struct page *page, struct vm_area_struct *vma)
if (address == -EFAULT)
goto out;
- pte = page_check_address(page, mm, address, &ptl);
+ pte = page_check_address(page, mm, address, &ptl, 1);
if (!pte)
goto out;
@@ -704,7 +708,7 @@ static int try_to_unmap_one(struct page *page, struct vm_area_struct *vma,
if (address == -EFAULT)
goto out;
- pte = page_check_address(page, mm, address, &ptl);
+ pte = page_check_address(page, mm, address, &ptl, 0);
if (!pte)
goto out;
Index: kernel.spec
===================================================================
RCS file: /cvs/pkgs/rpms/kernel/F-9/kernel.spec,v
retrieving revision 1.752
retrieving revision 1.753
diff -u -r1.752 -r1.753
--- kernel.spec 31 Aug 2008 01:43:46 -0000 1.752
+++ kernel.spec 31 Aug 2008 01:48:27 -0000 1.753
@@ -644,6 +644,8 @@
Patch820: linux-2.6-cpuidle-2-menu-governor-fix-wrong-usage-of-measured_us.patch
Patch830: linux-2.6-cpuidle-3-make-ladder-governor-honor-latency-requirements.patch
+Patch900: linux-2.6-mm-dirty-page-tracking-race-fix.patch
+
Patch1101: linux-2.6-default-mmf_dump_elf_headers.patch
Patch1400: linux-2.6-smarter-relatime.patch
Patch1515: linux-2.6-lirc.patch
@@ -1085,6 +1087,10 @@
ApplyPatch linux-2.6-cpuidle-2-menu-governor-fix-wrong-usage-of-measured_us.patch
ApplyPatch linux-2.6-cpuidle-3-make-ladder-governor-honor-latency-requirements.patch
+# mm
+# possible data corruption, esp. on ppc
+ApplyPatch linux-2.6-mm-dirty-page-tracking-race-fix.patch
+
# Various low-impact patches to aid debugging.
ApplyPatch linux-2.6-debug-sizeof-structs.patch
ApplyPatch linux-2.6-debug-nmi-timeout.patch
@@ -1813,6 +1819,9 @@
%kernel_variant_files -a /%{image_install_path}/xen*-%{KVERREL}.xen -e /etc/ld.so.conf.d/kernelcap-%{KVERREL}.xen.conf %{with_xen} xen
%changelog
+* Sat Aug 30 2008 Chuck Ebbert <cebbert at redhat.com> 2.6.26.3-26
+- mm: dirty page tracking race fix
+
* Sat Aug 30 2008 Chuck Ebbert <cebbert at redhat.com> 2.6.26.3-25
- block: submit_bh() inadvertently discards barrier flag on a sync write
More information about the fedora-extras-commits
mailing list