From: Matthew Wilcox <matthew.r.wilcox@intel.com>
To: linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org,
linux-mm@kvack.org
Cc: Matthew Wilcox <matthew.r.wilcox@intel.com>,
willy@linux.intel.com, Andrew Morton <akpm@linux-foundation.org>
Subject: [PATCH v12 03/20] mm: Fix XIP fault vs truncate race
Date: Fri, 24 Oct 2014 17:20:35 -0400 [thread overview]
Message-ID: <1414185652-28663-4-git-send-email-matthew.r.wilcox@intel.com> (raw)
In-Reply-To: <1414185652-28663-1-git-send-email-matthew.r.wilcox@intel.com>
Pagecache faults recheck i_size after taking the page lock to ensure that
the fault didn't race against a truncate. We don't have a page to lock
in the XIP case, so use the i_mmap_mutex instead. It is locked in the
truncate path in unmap_mapping_range() after updating i_size. So while
we hold it in the fault path, we are guaranteed that either i_size has
already been updated in the truncate path, or that the truncate will
subsequently call zap_page_range_single() and so remove the mapping we
have just inserted.
There is a window of time in which i_size has been reduced and the
thread has a mapping to a page which will be removed from the file,
but this is harmless as the page will not be allocated to a different
purpose before the thread's access to it is revoked.
Signed-off-by: Matthew Wilcox <matthew.r.wilcox@intel.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Acked-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Reviewed-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
---
mm/filemap_xip.c | 24 ++++++++++++++++++++++--
1 file changed, 22 insertions(+), 2 deletions(-)
diff --git a/mm/filemap_xip.c b/mm/filemap_xip.c
index d8d9fe3..c8d23e9 100644
--- a/mm/filemap_xip.c
+++ b/mm/filemap_xip.c
@@ -260,8 +260,17 @@ again:
__xip_unmap(mapping, vmf->pgoff);
found:
+ /* We must recheck i_size under i_mmap_mutex */
+ mutex_lock(&mapping->i_mmap_mutex);
+ size = (i_size_read(inode) + PAGE_CACHE_SIZE - 1) >>
+ PAGE_CACHE_SHIFT;
+ if (unlikely(vmf->pgoff >= size)) {
+ mutex_unlock(&mapping->i_mmap_mutex);
+ return VM_FAULT_SIGBUS;
+ }
err = vm_insert_mixed(vma, (unsigned long)vmf->virtual_address,
xip_pfn);
+ mutex_unlock(&mapping->i_mmap_mutex);
if (err == -ENOMEM)
return VM_FAULT_OOM;
/*
@@ -285,16 +294,27 @@ found:
}
if (error != -ENODATA)
goto out;
+
+ /* We must recheck i_size under i_mmap_mutex */
+ mutex_lock(&mapping->i_mmap_mutex);
+ size = (i_size_read(inode) + PAGE_CACHE_SIZE - 1) >>
+ PAGE_CACHE_SHIFT;
+ if (unlikely(vmf->pgoff >= size)) {
+ ret = VM_FAULT_SIGBUS;
+ goto unlock;
+ }
/* not shared and writable, use xip_sparse_page() */
page = xip_sparse_page();
if (!page)
- goto out;
+ goto unlock;
err = vm_insert_page(vma, (unsigned long)vmf->virtual_address,
page);
if (err == -ENOMEM)
- goto out;
+ goto unlock;
ret = VM_FAULT_NOPAGE;
+unlock:
+ mutex_unlock(&mapping->i_mmap_mutex);
out:
write_seqcount_end(&xip_sparse_seq);
mutex_unlock(&xip_sparse_mutex);
--
2.1.1
next prev parent reply other threads:[~2014-10-24 21:21 UTC|newest]
Thread overview: 60+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-10-24 21:20 [PATCH v12 00/20] DAX: Page cache bypass for filesystems on memory storage Matthew Wilcox
2014-10-24 21:20 ` [PATCH v12 01/20] axonram: Fix bug in direct_access Matthew Wilcox
2014-10-24 21:20 ` [PATCH v12 02/20] block: Change direct_access calling convention Matthew Wilcox
2014-10-24 21:20 ` Matthew Wilcox [this message]
2015-01-12 23:09 ` [PATCH v12 03/20] mm: Fix XIP fault vs truncate race Andrew Morton
2015-01-13 18:50 ` Matthew Wilcox
2014-10-24 21:20 ` [PATCH v12 04/20] mm: Allow page fault handlers to perform the COW Matthew Wilcox
2015-01-12 23:09 ` Andrew Morton
2015-01-13 18:58 ` Matthew Wilcox
2015-02-05 9:16 ` Yigal Korman
2015-02-05 21:39 ` Matthew Wilcox
2015-02-08 11:48 ` Yigal Korman
2014-10-24 21:20 ` [PATCH v12 05/20] vfs,ext2: Introduce IS_DAX(inode) Matthew Wilcox
2014-10-24 21:20 ` [PATCH v12 06/20] dax,ext2: Replace XIP read and write with DAX I/O Matthew Wilcox
2015-01-12 23:09 ` Andrew Morton
2015-01-13 20:59 ` Matthew Wilcox
2014-10-24 21:20 ` [PATCH v12 07/20] dax,ext2: Replace ext2_clear_xip_target with dax_clear_blocks Matthew Wilcox
2015-01-12 23:09 ` Andrew Morton
2015-01-13 21:39 ` Matthew Wilcox
2014-10-24 21:20 ` [PATCH v12 08/20] dax,ext2: Replace the XIP page fault handler with the DAX page fault handler Matthew Wilcox
2015-01-12 23:09 ` Andrew Morton
2015-01-13 21:53 ` Matthew Wilcox
2015-01-13 22:47 ` Andrew Morton
2014-10-24 21:20 ` [PATCH v12 09/20] dax,ext2: Replace xip_truncate_page with dax_truncate_page Matthew Wilcox
2015-01-12 23:09 ` Andrew Morton
2015-01-13 21:55 ` Matthew Wilcox
2014-10-24 21:20 ` [PATCH v12 10/20] dax: Replace XIP documentation with DAX documentation Matthew Wilcox
2015-01-12 23:10 ` Andrew Morton
2016-01-21 18:38 ` Jared Hulbert
2016-01-22 13:07 ` Wilcox, Matthew R
2016-01-22 13:48 ` Chris Brandt
2016-01-22 14:39 ` Matthew Wilcox
2016-01-24 9:03 ` Jared Hulbert
2016-01-25 16:52 ` Matthew Wilcox
2016-01-25 21:18 ` Jared Hulbert
2016-01-27 19:51 ` Jared Hulbert
2014-10-24 21:20 ` [PATCH v12 11/20] vfs: Remove get_xip_mem Matthew Wilcox
2014-10-24 21:20 ` [PATCH v12 12/20] ext2: Remove ext2_xip_verify_sb() Matthew Wilcox
2014-10-24 21:20 ` [PATCH v12 13/20] ext2: Remove ext2_use_xip Matthew Wilcox
2014-10-24 21:20 ` [PATCH v12 14/20] ext2: Remove xip.c and xip.h Matthew Wilcox
2014-10-24 21:20 ` [PATCH v12 15/20] vfs,ext2: Remove CONFIG_EXT2_FS_XIP and rename CONFIG_FS_XIP to CONFIG_FS_DAX Matthew Wilcox
2014-10-24 21:20 ` [PATCH v12 16/20] ext2: Remove ext2_aops_xip Matthew Wilcox
2014-10-24 21:20 ` [PATCH v12 17/20] ext2: Get rid of most mentions of XIP in ext2 Matthew Wilcox
2014-10-24 21:20 ` [PATCH v12 18/20] dax: Add dax_zero_page_range Matthew Wilcox
2015-01-12 23:10 ` Andrew Morton
2015-01-12 23:20 ` Ross Zwisler
2014-10-24 21:20 ` [PATCH v12 19/20] ext4: Add DAX functionality Matthew Wilcox
2014-10-24 21:20 ` [PATCH v12 20/20] brd: Rename XIP to DAX Matthew Wilcox
2014-12-10 14:03 ` [PATCH v12 00/20] DAX: Page cache bypass for filesystems on memory storage Christoph Hellwig
2014-12-10 14:12 ` Matthew Wilcox
2014-12-10 14:28 ` Jeff Moyer
2014-12-10 20:53 ` Dave Chinner
2015-01-05 18:41 ` Christoph Hellwig
2015-01-06 8:47 ` Andrew Morton
2015-01-08 11:49 ` pread2/ pwrite2 Christoph Hellwig
2015-01-09 19:30 ` Steve French
2015-01-08 16:28 ` [PATCH v12 00/20] DAX: Page cache bypass for filesystems on memory storage Milosz Tanski
2015-01-08 17:36 ` Jeremy Allison
2015-01-12 14:47 ` Matthew Wilcox
2015-01-12 23:09 ` Andrew Morton
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1414185652-28663-4-git-send-email-matthew.r.wilcox@intel.com \
--to=matthew.r.wilcox@intel.com \
--cc=akpm@linux-foundation.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=willy@linux.intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).