* [BUG] fs/aio: A possible sleep-in-atomic bug in aio_migratepage
@ 2017-10-07 1:36 Jia-Ju Bai
2017-10-07 2:31 ` Al Viro
0 siblings, 1 reply; 2+ messages in thread
From: Jia-Ju Bai @ 2017-10-07 1:36 UTC (permalink / raw)
To: bcrl, Al Viro; +Cc: linux-aio, linux-fsdevel, linux-kernel
According to fs/aio.c, cond_resched is called under a spinlock,
and the function call path is:
aio_migratepage (acquire the spinlock)
migrate_page_copy
copy_huge_page
__copy_gigantic_page
cond_resched
might_sleep
This bug is found by my static analysis tool and my code review.
A possible fix is to remove cond_resched in __copy_gigantic_page.
Thanks,
Jia-Ju Bai
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [BUG] fs/aio: A possible sleep-in-atomic bug in aio_migratepage
2017-10-07 1:36 [BUG] fs/aio: A possible sleep-in-atomic bug in aio_migratepage Jia-Ju Bai
@ 2017-10-07 2:31 ` Al Viro
0 siblings, 0 replies; 2+ messages in thread
From: Al Viro @ 2017-10-07 2:31 UTC (permalink / raw)
To: Jia-Ju Bai; +Cc: bcrl, linux-aio, linux-fsdevel, linux-kernel
On Sat, Oct 07, 2017 at 09:36:48AM +0800, Jia-Ju Bai wrote:
> According to fs/aio.c, cond_resched is called under a spinlock,
> and the function call path is:
> aio_migratepage (acquire the spinlock)
> migrate_page_copy
> copy_huge_page
> __copy_gigantic_page
> cond_resched
> might_sleep
>
> This bug is found by my static analysis tool and my code review.
> A possible fix is to remove cond_resched in __copy_gigantic_page.
How the hell would a huge page end up in page cache of inode created
by aio_private_file()???
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2017-10-07 2:31 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-10-07 1:36 [BUG] fs/aio: A possible sleep-in-atomic bug in aio_migratepage Jia-Ju Bai
2017-10-07 2:31 ` Al Viro
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).