From: Matthew Wilcox <matthew.r.wilcox@intel.com> To: linux-fsdevel@vger.kernel.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org Cc: Matthew Wilcox <matthew.r.wilcox@intel.com>, willy@linux.intel.com Subject: [PATCH v10 03/21] Fix XIP fault vs truncate race Date: Tue, 26 Aug 2014 23:45:23 -0400 [thread overview] Message-ID: <5ab44810d012796b3df4e8262691bc998f99f5d6.1409110741.git.matthew.r.wilcox@intel.com> (raw) In-Reply-To: <cover.1409110741.git.matthew.r.wilcox@intel.com> In-Reply-To: <cover.1409110741.git.matthew.r.wilcox@intel.com> Pagecache faults recheck i_size after taking the page lock to ensure that the fault didn't race against a truncate. We don't have a page to lock in the XIP case, so use the i_mmap_mutex instead. It is locked in the truncate path in unmap_mapping_range() after updating i_size. So while we hold it in the fault path, we are guaranteed that either i_size has already been updated in the truncate path, or that the truncate will subsequently call zap_page_range_single() and so remove the mapping we have just inserted. There is a window of time in which i_size has been reduced and the thread has a mapping to a page which will be removed from the file, but this is harmless as the page will not be allocated to a different purpose before the thread's access to it is revoked. Signed-off-by: Matthew Wilcox <matthew.r.wilcox@intel.com> Reviewed-by: Jan Kara <jack@suse.cz> Acked-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com> --- mm/filemap_xip.c | 24 ++++++++++++++++++++++-- 1 file changed, 22 insertions(+), 2 deletions(-) diff --git a/mm/filemap_xip.c b/mm/filemap_xip.c index d8d9fe3..c8d23e9 100644 --- a/mm/filemap_xip.c +++ b/mm/filemap_xip.c @@ -260,8 +260,17 @@ again: __xip_unmap(mapping, vmf->pgoff); found: + /* We must recheck i_size under i_mmap_mutex */ + mutex_lock(&mapping->i_mmap_mutex); + size = (i_size_read(inode) + PAGE_CACHE_SIZE - 1) >> + PAGE_CACHE_SHIFT; + if (unlikely(vmf->pgoff >= size)) { + mutex_unlock(&mapping->i_mmap_mutex); + return VM_FAULT_SIGBUS; + } err = vm_insert_mixed(vma, (unsigned long)vmf->virtual_address, xip_pfn); + mutex_unlock(&mapping->i_mmap_mutex); if (err == -ENOMEM) return VM_FAULT_OOM; /* @@ -285,16 +294,27 @@ found: } if (error != -ENODATA) goto out; + + /* We must recheck i_size under i_mmap_mutex */ + mutex_lock(&mapping->i_mmap_mutex); + size = (i_size_read(inode) + PAGE_CACHE_SIZE - 1) >> + PAGE_CACHE_SHIFT; + if (unlikely(vmf->pgoff >= size)) { + ret = VM_FAULT_SIGBUS; + goto unlock; + } /* not shared and writable, use xip_sparse_page() */ page = xip_sparse_page(); if (!page) - goto out; + goto unlock; err = vm_insert_page(vma, (unsigned long)vmf->virtual_address, page); if (err == -ENOMEM) - goto out; + goto unlock; ret = VM_FAULT_NOPAGE; +unlock: + mutex_unlock(&mapping->i_mmap_mutex); out: write_seqcount_end(&xip_sparse_seq); mutex_unlock(&xip_sparse_mutex); -- 2.0.0
WARNING: multiple messages have this Message-ID (diff)
From: Matthew Wilcox <matthew.r.wilcox@intel.com> To: linux-fsdevel@vger.kernel.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org Cc: Matthew Wilcox <matthew.r.wilcox@intel.com>, willy@linux.intel.com Subject: [PATCH v10 03/21] Fix XIP fault vs truncate race Date: Tue, 26 Aug 2014 23:45:23 -0400 [thread overview] Message-ID: <5ab44810d012796b3df4e8262691bc998f99f5d6.1409110741.git.matthew.r.wilcox@intel.com> (raw) In-Reply-To: <cover.1409110741.git.matthew.r.wilcox@intel.com> In-Reply-To: <cover.1409110741.git.matthew.r.wilcox@intel.com> Pagecache faults recheck i_size after taking the page lock to ensure that the fault didn't race against a truncate. We don't have a page to lock in the XIP case, so use the i_mmap_mutex instead. It is locked in the truncate path in unmap_mapping_range() after updating i_size. So while we hold it in the fault path, we are guaranteed that either i_size has already been updated in the truncate path, or that the truncate will subsequently call zap_page_range_single() and so remove the mapping we have just inserted. There is a window of time in which i_size has been reduced and the thread has a mapping to a page which will be removed from the file, but this is harmless as the page will not be allocated to a different purpose before the thread's access to it is revoked. Signed-off-by: Matthew Wilcox <matthew.r.wilcox@intel.com> Reviewed-by: Jan Kara <jack@suse.cz> Acked-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com> --- mm/filemap_xip.c | 24 ++++++++++++++++++++++-- 1 file changed, 22 insertions(+), 2 deletions(-) diff --git a/mm/filemap_xip.c b/mm/filemap_xip.c index d8d9fe3..c8d23e9 100644 --- a/mm/filemap_xip.c +++ b/mm/filemap_xip.c @@ -260,8 +260,17 @@ again: __xip_unmap(mapping, vmf->pgoff); found: + /* We must recheck i_size under i_mmap_mutex */ + mutex_lock(&mapping->i_mmap_mutex); + size = (i_size_read(inode) + PAGE_CACHE_SIZE - 1) >> + PAGE_CACHE_SHIFT; + if (unlikely(vmf->pgoff >= size)) { + mutex_unlock(&mapping->i_mmap_mutex); + return VM_FAULT_SIGBUS; + } err = vm_insert_mixed(vma, (unsigned long)vmf->virtual_address, xip_pfn); + mutex_unlock(&mapping->i_mmap_mutex); if (err == -ENOMEM) return VM_FAULT_OOM; /* @@ -285,16 +294,27 @@ found: } if (error != -ENODATA) goto out; + + /* We must recheck i_size under i_mmap_mutex */ + mutex_lock(&mapping->i_mmap_mutex); + size = (i_size_read(inode) + PAGE_CACHE_SIZE - 1) >> + PAGE_CACHE_SHIFT; + if (unlikely(vmf->pgoff >= size)) { + ret = VM_FAULT_SIGBUS; + goto unlock; + } /* not shared and writable, use xip_sparse_page() */ page = xip_sparse_page(); if (!page) - goto out; + goto unlock; err = vm_insert_page(vma, (unsigned long)vmf->virtual_address, page); if (err == -ENOMEM) - goto out; + goto unlock; ret = VM_FAULT_NOPAGE; +unlock: + mutex_unlock(&mapping->i_mmap_mutex); out: write_seqcount_end(&xip_sparse_seq); mutex_unlock(&xip_sparse_mutex); -- 2.0.0 -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>
next prev parent reply other threads:[~2014-08-27 4:40 UTC|newest] Thread overview: 104+ messages / expand[flat|nested] mbox.gz Atom feed top 2014-08-27 3:45 [PATCH v10 00/21] Support ext4 on NV-DIMMs Matthew Wilcox 2014-08-27 3:45 ` Matthew Wilcox 2014-08-27 3:45 ` [PATCH v10 01/21] axonram: Fix bug in direct_access Matthew Wilcox 2014-08-27 3:45 ` Matthew Wilcox 2014-08-27 3:45 ` [PATCH v10 02/21] Change direct_access calling convention Matthew Wilcox 2014-08-27 3:45 ` Matthew Wilcox 2014-08-27 3:45 ` Matthew Wilcox [this message] 2014-08-27 3:45 ` [PATCH v10 03/21] Fix XIP fault vs truncate race Matthew Wilcox 2014-08-27 3:45 ` [PATCH v10 04/21] Allow page fault handlers to perform the COW Matthew Wilcox 2014-08-27 3:45 ` Matthew Wilcox 2014-08-27 3:45 ` [PATCH v10 05/21] Introduce IS_DAX(inode) Matthew Wilcox 2014-08-27 3:45 ` Matthew Wilcox 2014-08-27 3:45 ` [PATCH v10 06/21] Add copy_to_iter(), copy_from_iter() and iov_iter_zero() Matthew Wilcox 2014-08-27 3:45 ` Matthew Wilcox 2014-08-27 3:45 ` [PATCH v10 07/21] Replace XIP read and write with DAX I/O Matthew Wilcox 2014-08-27 3:45 ` Matthew Wilcox 2014-09-14 14:11 ` Boaz Harrosh 2014-09-14 14:11 ` Boaz Harrosh 2014-08-27 3:45 ` [PATCH v10 08/21] Replace ext2_clear_xip_target with dax_clear_blocks Matthew Wilcox 2014-08-27 3:45 ` Matthew Wilcox 2014-08-27 3:45 ` [PATCH v10 09/21] Replace the XIP page fault handler with the DAX page fault handler Matthew Wilcox 2014-08-27 3:45 ` Matthew Wilcox 2014-09-03 7:47 ` Dave Chinner 2014-09-03 7:47 ` Dave Chinner 2014-09-10 15:23 ` Matthew Wilcox 2014-09-10 15:23 ` Matthew Wilcox 2014-09-11 3:09 ` Dave Chinner 2014-09-11 3:09 ` Dave Chinner 2014-09-24 15:43 ` Matthew Wilcox 2014-09-24 15:43 ` Matthew Wilcox 2014-09-25 1:01 ` Dave Chinner 2014-09-25 1:01 ` Dave Chinner 2014-08-27 3:45 ` [PATCH v10 10/21] Replace xip_truncate_page with dax_truncate_page Matthew Wilcox 2014-08-27 3:45 ` Matthew Wilcox 2014-08-27 3:45 ` [PATCH v10 11/21] Replace XIP documentation with DAX documentation Matthew Wilcox 2014-08-27 3:45 ` Matthew Wilcox 2014-08-27 3:45 ` [PATCH v10 12/21] Remove get_xip_mem Matthew Wilcox 2014-08-27 3:45 ` Matthew Wilcox 2014-08-27 3:45 ` [PATCH v10 13/21] ext2: Remove ext2_xip_verify_sb() Matthew Wilcox 2014-08-27 3:45 ` Matthew Wilcox 2014-08-27 3:45 ` [PATCH v10 14/21] ext2: Remove ext2_use_xip Matthew Wilcox 2014-08-27 3:45 ` Matthew Wilcox 2014-08-27 3:45 ` [PATCH v10 15/21] ext2: Remove xip.c and xip.h Matthew Wilcox 2014-08-27 3:45 ` Matthew Wilcox 2014-08-27 3:45 ` [PATCH v10 16/21] Remove CONFIG_EXT2_FS_XIP and rename CONFIG_FS_XIP to CONFIG_FS_DAX Matthew Wilcox 2014-08-27 3:45 ` Matthew Wilcox 2014-08-27 3:45 ` [PATCH v10 17/21] ext2: Remove ext2_aops_xip Matthew Wilcox 2014-08-27 3:45 ` Matthew Wilcox 2014-08-27 3:45 ` [PATCH v10 18/21] Get rid of most mentions of XIP in ext2 Matthew Wilcox 2014-08-27 3:45 ` Matthew Wilcox 2014-08-27 3:45 ` [PATCH v10 19/21] xip: Add xip_zero_page_range Matthew Wilcox 2014-08-27 3:45 ` Matthew Wilcox 2014-09-03 9:21 ` Dave Chinner 2014-09-03 9:21 ` Dave Chinner 2014-09-04 21:08 ` Matthew Wilcox 2014-09-04 21:08 ` Matthew Wilcox 2014-09-04 21:36 ` Theodore Ts'o 2014-09-04 21:36 ` Theodore Ts'o 2014-09-08 18:59 ` Matthew Wilcox 2014-09-08 18:59 ` Matthew Wilcox 2014-08-27 3:45 ` [PATCH v10 20/21] ext4: Add DAX functionality Matthew Wilcox 2014-08-27 3:45 ` Matthew Wilcox 2014-09-03 11:13 ` Dave Chinner 2014-09-03 11:13 ` Dave Chinner 2014-09-10 16:49 ` Boaz Harrosh 2014-09-10 16:49 ` Boaz Harrosh 2014-09-11 4:38 ` Dave Chinner 2014-09-11 4:38 ` Dave Chinner 2014-09-14 12:25 ` Boaz Harrosh 2014-09-14 12:25 ` Boaz Harrosh 2014-09-15 6:15 ` Dave Chinner 2014-09-15 6:15 ` Dave Chinner 2014-09-15 9:41 ` Boaz Harrosh 2014-09-15 9:41 ` Boaz Harrosh 2014-08-27 3:45 ` [PATCH v10 21/21] brd: Rename XIP to DAX Matthew Wilcox 2014-08-27 3:45 ` Matthew Wilcox 2014-08-27 20:06 ` [PATCH v10 00/21] Support ext4 on NV-DIMMs Andrew Morton 2014-08-27 20:06 ` Andrew Morton 2014-08-27 21:12 ` Matthew Wilcox 2014-08-27 21:12 ` Matthew Wilcox 2014-08-27 21:46 ` Andrew Morton 2014-08-27 21:46 ` Andrew Morton 2014-08-28 1:30 ` Andy Lutomirski 2014-08-28 1:30 ` Andy Lutomirski 2014-08-28 16:50 ` Matthew Wilcox 2014-08-28 16:50 ` Matthew Wilcox 2014-08-28 15:45 ` Matthew Wilcox 2014-08-28 15:45 ` Matthew Wilcox 2014-08-27 21:22 ` Christoph Lameter 2014-08-27 21:22 ` Christoph Lameter 2014-08-27 21:30 ` Andrew Morton 2014-08-27 21:30 ` Andrew Morton 2014-08-27 23:04 ` One Thousand Gnomes 2014-08-27 23:04 ` One Thousand Gnomes 2014-08-28 7:17 ` Dave Chinner 2014-08-28 7:17 ` Dave Chinner 2014-08-30 23:11 ` Christian Stroetmann 2014-08-30 23:11 ` Christian Stroetmann 2014-08-28 8:08 ` Boaz Harrosh 2014-08-28 8:08 ` Boaz Harrosh 2014-08-28 22:09 ` Zwisler, Ross 2014-08-28 22:09 ` Zwisler, Ross 2014-09-03 12:05 ` [PATCH 1/1] xfs: add DAX support Dave Chinner 2014-09-03 12:05 ` Dave Chinner
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=5ab44810d012796b3df4e8262691bc998f99f5d6.1409110741.git.matthew.r.wilcox@intel.com \ --to=matthew.r.wilcox@intel.com \ --cc=linux-fsdevel@vger.kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-mm@kvack.org \ --cc=willy@linux.intel.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.