[lkml]   [2007]   [Nov]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Patch in this message
Subject[patch 15/19] x86: fix global_flush_tlb() bug
-stable review patch.  If anyone has any objections, please let us know.

From: Ingo Molnar <>
patch 9a24d04a3c26c223f22493492c5c9085b8773d4a upstream

While we were reviewing pageattr_32/64.c for unification,
Thomas Gleixner noticed the following serious SMP bug in

list_replace_init(&deferred_pages, &l);

this is SMP-unsafe because list_replace_init() done on two CPUs in
parallel can corrupt the list.

This bug has been introduced about a year ago in the 64-bit tree:

commit ea7322decb974a4a3e804f96a0201e893ff88ce3
Author: Andi Kleen <>
Date: Thu Dec 7 02:14:05 2006 +0100

[PATCH] x86-64: Speed and clean up cache flushing in change_page_attr

- dpage = xchg(&deferred_pages, NULL);
+ list_replace_init(&deferred_pages, &l);

the xchg() based version was SMP-safe, but list_replace_init() is not.
So this "cleanup" introduced a nasty bug.

why this bug never become prominent is a mystery - it can probably be
explained with the (still) relative obscurity of the x86_64 architecture.

the safe fix for now is to write-lock init_mm.mmap_sem.

Signed-off-by: Ingo Molnar <>
Signed-off-by: Thomas Gleixner <>
Cc: Andi Kleen <>
Cc: Andrew Morton <>
Signed-off-by: Greg Kroah-Hartman <>

arch/x86_64/mm/pageattr.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
--- a/arch/x86_64/mm/pageattr.c
+++ b/arch/x86_64/mm/pageattr.c
@@ -229,9 +229,14 @@ void global_flush_tlb(void)
struct page *pg, *next;
struct list_head l;

- down_read(&init_mm.mmap_sem);
+ /*
+ * Write-protect the semaphore, to exclude two contexts
+ * doing a list_replace_init() call in parallel and to
+ * exclude new additions to the deferred_pages list:
+ */
+ down_write(&init_mm.mmap_sem);
list_replace_init(&deferred_pages, &l);
- up_read(&init_mm.mmap_sem);
+ up_write(&init_mm.mmap_sem);


To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
More majordomo info at
Please read the FAQ at

 \ /
  Last update: 2007-11-15 07:25    [from the cache]
©2003-2014 Jasper Spaans. hosted at Digital Ocean