[lkml]   [2018]   [Oct]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Subject[PATCH RFC v2 0/1] hugetlbfs: Use i_mmap_rwsem for pmd share and fault/trunc
This patch addresses issues with page fault/truncation synchronization.
The first issue was noticed as a negative hugetlb reserved page counts
during DB development testing. Code inspection revealed that the most
likely cause were races with truncate and page faults. In fact, I could
write a not too complicated program to cause the races and recreate the

A more dangerous issue exists when you introduce huge pmd sharing to
page fault/truncate races. The fist thing that happens in huge page
fault processing is a call to huge_pte_alloc to get a ptep. Suppose
that ptep points to a shared pmd. Now, another thread could perform
a truncate and unmap everyone mapping the file. huge_pmd_unshare can
be called for the mapping on which the first thread is operating.
huge_pmd_unshare can clear pud pointing to the pmd. After this, the
ptep points to another task's page table or worse. This leads to bad
things such as incorrect page map/reference counts or invaid memory

Fix this all by modifying the usage of i_mmap_rwsem to cover
fault/truncate races as well as handling of shared pmds

Mike Kravetz (1):
hugetlbfs: use i_mmap_rwsem for pmd sharing and truncate/fault sync

fs/hugetlbfs/inode.c | 21 ++++++++++----
mm/hugetlb.c | 65 +++++++++++++++++++++++++++++++++-----------
mm/rmap.c | 10 +++++++
mm/userfaultfd.c | 11 ++++++--
4 files changed, 84 insertions(+), 23 deletions(-)


 \ /
  Last update: 2018-10-24 06:55    [W:0.041 / U:23.724 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site