Benjamin Herrenschmidt
2efaca927f
mm/futex: fix futex writes on archs with SW tracking of dirty & young ...
I haven't reproduced it myself but the fail scenario is that on such
machines (notably ARM and some embedded powerpc), if you manage to hit
that futex path on a writable page whose dirty bit has gone from the PTE,
you'll livelock inside the kernel from what I can tell.
It will go in a loop of trying the atomic access, failing, trying gup to
"fix it up", getting succcess from gup, go back to the atomic access,
failing again because dirty wasn't fixed etc...
So I think you essentially hang in the kernel.
The scenario is probably rare'ish because affected architecture are
embedded and tend to not swap much (if at all) so we probably rarely hit
the case where dirty is missing or young is missing, but I think Shan has
a piece of SW that can reliably reproduce it using a shared writable
mapping & fork or something like that.
On archs who use SW tracking of dirty & young, a page without dirty is
effectively mapped read-only and a page without young unaccessible in the
PTE.
Additionally, some architectures might lazily flush the TLB when relaxing
write protection (by doing only a local flush), and expect a fault to
invalidate the stale entry if it's still present on another processor.
The futex code assumes that if the "in_atomic()" access -EFAULT's, it can
"fix it up" by causing get_user_pages() which would then be equivalent to
taking the fault.
However that isn't the case. get_user_pages() will not call
handle_mm_fault() in the case where the PTE seems to have the right
permissions, regardless of the dirty and young state. It will eventually
update those bits ... in the struct page, but not in the PTE.
Additionally, it will not handle the lazy TLB flushing that can be
required by some architectures in the fault case.
Basically, gup is the wrong interface for the job. The patch provides a
more appropriate one which boils down to just calling handle_mm_fault()
since what we are trying to do is simulate a real page fault.
The futex code currently attempts to write to user memory within a
pagefault disabled section, and if that fails, tries to fix it up using
get_user_pages().
This doesn't work on archs where the dirty and young bits are maintained
by software, since they will gate access permission in the TLB, and will
not be updated by gup().
In addition, there's an expectation on some archs that a spurious write
fault triggers a local TLB flush, and that is missing from the picture as
well.
I decided that adding those "features" to gup() would be too much for this
already too complex function, and instead added a new simpler
fixup_user_fault() which is essentially a wrapper around handle_mm_fault()
which the futex code can call.
[akpm@linux-foundation.org: coding-style fixes]
[akpm@linux-foundation.org: fix some nits Darren saw, fiddle comment layout]
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Reported-by: Shan Hai <haishan.bai@gmail.com>
Tested-by: Shan Hai <haishan.bai@gmail.com>
Cc: David Laight <David.Laight@ACULAB.COM>
Acked-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: Darren Hart <darren.hart@intel.com>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2011-07-25 20:57:11 -07:00
amba pl011: workaround for uart registers lockup
2011-06-16 12:01:57 -07:00
bcma: inform drivers about translation bits needed for the core
2011-07-22 09:51:12 -04:00
backlight: new driver for the ADP8870 backlight devices
2011-06-15 20:03:59 -07:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input
2011-06-20 08:59:46 -07:00
mmc: sdhi: Add write16_hook
2011-07-20 17:20:57 -04:00
IB/mlx4: Use flow counters on IBoE ports
2011-07-18 21:04:36 -07:00
mmc: core: Set non-default Drive Strength via platform hook
2011-07-20 17:21:16 -04:00
Merge branch 'linux-next' of git://git.infradead.org/ubi-2.6
2011-07-22 13:09:55 -07:00
Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/kaber/nf-next-2.6
2011-07-21 12:39:35 -07:00
mmc: sdhci-pxa: move platform data to include/linux/platform_data
2011-07-20 17:20:52 -04:00
mcp23s08: get rid of setup/teardown callbacks
2011-07-15 13:54:17 -06:00
ssb: SPROM: add LED duty cycle fields
2011-07-18 14:29:04 -04:00
Merge branch 'bugfixes' of git://git.linux-nfs.org/projects/trondmy/nfs-2.6
2011-06-21 18:20:55 -07:00
net: remove SK_ROUTE_CAPS from meta ematch
2011-07-14 14:45:59 -07:00
iommu/amd: Move missing parts to drivers/iommu
2011-06-21 10:49:31 +02:00
anonfd: fix missing declaration
2011-07-20 20:47:43 -04:00
net: remove interrupt.h inclusion from netdevice.h
2011-06-06 22:55:11 -07:00
ath9k: add external_reset callback to ath9k_platfom_data for AR9330
2011-06-22 16:09:57 -04:00
lockless get_write_access/deny_write_access
2011-07-20 01:43:14 -04:00
netfilter: add SELinux context support to AUDIT target
2011-06-30 13:31:57 +02:00
gpio/basic_mmio: add missing include of spinlock_types.h
2011-06-10 08:46:26 -06:00
consolidate BINPRM_FLAGS_ENFORCE_NONDUMP handling
2011-07-20 01:43:10 -04:00
sched: Isolate preempt counting in its own config option
2011-06-10 15:15:40 +02:00
block: add REQ_SECURE to REQ_COMMON_MASK
2011-06-20 13:23:14 +02:00
block: remove unwanted semicolons
2011-05-31 13:45:53 +02:00
block: Add __attribute__((format(printf...) and fix fallout
2011-06-13 10:42:49 +02:00
Merge branch 'x86-vdso-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip
2011-07-22 17:05:15 -07:00
connector: add an event for monitoring process tracers
2011-07-18 21:38:33 +02:00
include/linux/compat.h: declare compat_sys_sendmmsg()
2011-06-27 18:00:13 -07:00
Connector: Set the CN_NETLINK_USERS correctly
2011-06-07 12:02:00 -07:00
lib: cordic: add library module providing cordic angle calculation
2011-06-03 15:01:07 -04:00
lib: crc8: add new library module providing crc8 algorithm
2011-06-03 15:01:06 -04:00
kill lookup_create()
2011-07-20 01:44:12 -04:00
dcbnl: Aggregated CEE GET operation
2011-07-05 23:42:17 -07:00
net: remove interrupt.h inclusion from netdevice.h
2011-06-06 22:55:11 -07:00
dm table: allow targets to support discards internally
2011-05-29 12:52:55 +01:00
PM / Domains: Rename struct dev_power_domain to struct dev_pm_domain
2011-07-02 14:29:54 +02:00
devcgroup_inode_permission: take "is it a device node" checks to inlined wrapper
2011-06-20 10:46:04 -04:00
dm io: use fixed initial mempool size
2011-05-29 13:03:09 +01:00
dm kcopyd: return client directly and not through a pointer
2011-05-29 13:03:13 +01:00
net: remove mm.h inclusion from netdevice.h
2011-06-21 19:17:20 -07:00
net: remove mm.h inclusion from netdevice.h
2011-06-21 19:17:20 -07:00
intel-iommu: Enable super page (2MiB, 1GiB, etc.) support
2011-06-01 12:26:35 +01:00
net: remove mm.h inclusion from netdevice.h
2011-06-21 19:17:20 -07:00
drbd: fix limit define, we support 1 PiByte now
2011-06-30 09:23:45 +02:00
clocksource: apb: Share APB timer code with other platforms
2011-06-27 15:16:21 -07:00
x86, efi: Add infrastructure for UEFI 2.0 runtime services
2011-06-06 13:30:30 -07:00
net: Push protocol type directly down to header_ops->cache()
2011-07-13 02:29:59 -07:00
net: add external loopback test in ethtool self test
2011-06-30 22:32:49 -07:00
fs: push i_mutex and filemap_write_and_wait down into ->fsync() handlers
2011-07-20 20:47:59 -04:00
fs: push i_mutex and filemap_write_and_wait down into ->fsync() handlers
2011-07-20 20:47:59 -04:00
firewire: cdev: ABI documentation enhancements
2011-07-16 07:24:32 +02:00
mm/truncate.c: fix build for CONFIG_BLOCK not enabled
2011-07-22 19:41:19 -04:00
FS-Cache: Add a helper to bulk uncache pages on an inode
2011-07-07 13:21:56 -07:00
fsl-diu-fb: remove check for pixel clock ranges
2011-06-24 17:08:49 +09:00
ftrace: Fix warning when CONFIG_FUNCTION_TRACER is not defined
2011-07-11 10:12:59 -04:00
tracing: Have dynamic size event stack traces
2011-07-14 16:36:53 -04:00
->permission() sanitizing: don't pass flags to ->check_acl()
2011-07-20 01:43:21 -04:00
Revert "block: Remove extra discard_alignment from hd_struct."
2011-05-30 07:42:51 +02:00
gpio: add GPIOF_ values regardless on kconfig settings
2011-06-16 08:40:52 -06:00
sched: Isolate preempt counting in its own config option
2011-06-10 15:15:40 +02:00
HID: yurex: recognize GeneralKeys wireless presenter as generic HID
2011-06-07 15:34:17 +02:00
Fix some kernel-doc warnings
2011-06-27 16:06:19 -07:00
hugetlb: add phys addr to struct huge_bootmem_page
2011-07-25 20:57:07 -07:00
perf: Add context field to perf_event
2011-07-01 11:06:38 +02:00
i8253: Cleanup outb/inb magic
2011-07-01 10:37:15 +02:00
ieee80211: add few wmm tspec values
2011-07-19 16:49:54 -04:00
net: add 802.1ad / 802.1ah / QinQ ethertypes
2011-07-17 12:33:22 -07:00
packet: Add 'cpu' fanout policy.
2011-07-06 01:56:38 -07:00
vlan: move vlan_group_[gs]et_device to public header
2011-07-21 13:47:58 -07:00
lro: do vlan cleanup
2011-07-21 13:47:54 -07:00
rcu: Use softirq to address performance regression
2011-06-14 15:25:39 -07:00
iommu-api: Add missing header file
2011-06-14 11:30:22 +02:00
Merge branches 'x86-urgent-for-linus', 'core-debug-for-linus', 'irq-core-for-linus' and 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip
2011-07-23 10:33:08 -07:00
irq: Handle spurios irq detection for threaded irqs
2011-06-03 14:53:15 +02:00
[SCSI] iscsi_ibft, be2iscsi, iscsi_boot: fix boot kobj data lifetime management
2011-06-29 16:43:06 -05:00
jbd2: Fix oops in jbd2_journal_remove_journal_head()
2011-06-13 15:38:22 -04:00
Merge branch 'sched/core-v2' of git://git.kernel.org/pub/scm/linux/kernel/git/frederic/random-tracing into sched/core
2011-07-01 13:20:51 +02:00
KEYS/DNS: Fix ____call_usermodehelper() to not lose the session keyring
2011-06-17 09:40:48 -07:00
kmsg_dump.h: fix build when CONFIG_PRINTK is disabled
2011-06-15 20:03:59 -07:00
Delay struct net freeing while there's a sysfs instance refering to it
2011-06-12 17:45:41 -04:00
KVM: PPC: Allocate RMAs (Real Mode Areas) at boot for use by guests
2011-07-12 13:16:57 +03:00
KVM: MMU: filter out the mmio pfn from the fault pfn
2011-07-24 11:50:34 +03:00
lguest: use a special 1:1 linear pagetable mode until first switch.
2011-07-22 14:39:48 +09:30
ata: Add and use ata_print_version_once
2011-07-23 17:57:36 -04:00
vmscan,memcg: memcg aware swap token
2011-06-15 20:03:59 -07:00
mm: Move definition of MIN_MEMORY_BLOCK_SIZE to a header
2011-07-12 11:08:01 +10:00
mm: extend memory hotplug API to allow memory hotplug in virtual machines
2011-07-25 20:57:08 -07:00
tg3: Migrate phy preprocessor defs to system defs
2011-06-15 11:11:57 -04:00
mm/futex: fix futex writes on archs with SW tracking of dirty & young
2011-07-25 20:57:11 -07:00
mm: Fix boot crash in mm_alloc()
2011-05-29 11:32:28 -07:00
Fix node_start/end_pfn() definition for mm/page_cgroup.c
2011-06-27 14:13:09 -07:00
fs: seq_file - add event counter to simplify poll() support
2011-07-20 20:47:50 -04:00
module: add /sys/module/<name>/uevent files
2011-07-24 22:06:04 +09:30
modules: add default loader hook implementations
2011-07-24 22:06:04 +09:30
mutex: Make mutex_destroy() an inline function
2011-07-21 09:36:09 +02:00
switch vfs_path_lookup() to struct path
2011-07-20 01:44:14 -04:00
net: Kobj and queues_kset should be used when CONFIG_XPS is enabled
2011-07-21 20:39:47 -07:00
Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next-2.6 into for-davem
2011-06-24 15:25:51 -04:00
netpoll: Remove unused EXPORT_SYMBOLs of netpoll_poll and netpoll_poll_dev
2011-07-03 20:02:07 -07:00
NFC: add the NFC socket raw protocol
2011-07-05 15:26:58 -04:00
Merge branch 'pnfs-submit' of git://git.open-osd.org/linux-open-osd
2011-05-29 14:10:13 -07:00
nfs_open_context doesn't need struct path either
2011-07-20 01:43:44 -04:00
NFSv4.1: file layout must consider pg_bsize for coalescing
2011-06-20 16:12:26 -04:00
NFSv4.1: deprecate headerpadsz in CREATE_SESSION
2011-06-15 11:24:28 -04:00
cfg80211: allow userspace to control supported rates in scan
2011-07-19 16:49:58 -04:00
make sure that nsproxy_cache is initialized early enough
2011-07-20 01:44:07 -04:00
dt: add empty of_property_read_u32[_array] for non-dt
2011-07-08 12:52:33 -06:00
dt: include linux/errno.h in linux/of_address.h
2011-07-18 16:37:45 -06:00
of/gpio: Add new method for getting gpios under different property names
2011-06-28 15:39:50 -06:00
pci/of: Match PCI devices to OF nodes dynamically
2011-06-08 09:08:17 +10:00
dt/platform: allow device name to be overridden
2011-06-21 11:04:10 -06:00
oom: remove references to old badness() function
2011-07-25 20:57:09 -07:00
PM / OPP: Introduce function to free cpufreq table
2011-07-15 23:58:18 +02:00
mm: use const struct page for r/o page-flag accessor methods
2011-07-25 20:57:07 -07:00
mm: cleanup descriptions of filler arg
2011-07-25 20:57:10 -07:00
Merge branch 'core-iommu-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip
2011-07-22 16:39:42 -07:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6
2011-07-23 10:59:37 -07:00
slub: always align cpu_slab to honor cmpxchg_double requirement
2011-06-03 19:33:49 +03:00
perf: export perf_event_refresh() to modules
2011-07-01 11:06:40 +02:00
plist: Remove the need to supply locks to plist heads
2011-07-08 14:02:53 +02:00
PM: Introduce generic "noirq" callback routines for subsystems (v2)
2011-07-02 14:29:55 +02:00
ARM / shmobile: Use genpd_queue_power_off_work()
2011-07-14 20:59:07 +02:00
idle governor: Avoid lock acquisition to read pm_qos before entering idle
2011-05-29 00:50:59 -04:00
PM / Runtime: Add new helper function: pm_runtime_status_suspended()
2011-07-12 11:17:09 +02:00
pnfs-obj: pnfs_osd XDR definitions
2011-05-29 20:52:36 +03:00
mm/memblock.c: avoid abuse of RED_INACTIVE
2011-07-25 20:57:09 -07:00
sched: Isolate preempt counting in its own config option
2011-06-10 15:15:40 +02:00
ptrace: dont send SIGSTOP on auto-attach if PT_SEIZED
2011-07-17 20:23:52 +02:00
ipv6: make fragment identifications less predictable
2011-07-21 21:25:58 -07:00
rcu: Fix wrong check in list_splice_init_rcu()
2011-07-20 14:10:20 -07:00
sched: Isolate preempt counting in its own config option
2011-06-10 15:15:40 +02:00
regmap: Add SPI bus support
2011-07-23 07:56:59 +01:00
->permission() sanitizing: don't pass flags to ->permission()
2011-07-20 01:43:24 -04:00
tracing: Use NUMA allocation for per-cpu ring buffer pages
2011-06-14 22:04:39 -04:00
plist: Remove the need to supply locks to plist heads
2011-07-08 14:02:53 +02:00
net: dcbnl, add multicast group for DCB
2011-06-21 16:06:11 -07:00
rw_semaphore: remove up/down_read_non_owner
2011-07-20 20:47:47 -04:00
Merge branch 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip
2011-07-22 16:45:02 -07:00
include/linux/sdla.h: remove the prototype of sdla()
2011-07-18 11:06:03 -07:00
x86-64: Emulate legacy vsyscalls
2011-06-07 10:02:35 +02:00
->permission() sanitizing: don't pass flags to exec_permission()
2011-07-20 01:43:29 -04:00
fs: seq_file - add event counter to simplify poll() support
2011-07-20 20:47:50 -04:00
linux/seqlock.h should #include asm/processor.h for cpu_relax()
2011-06-11 13:17:28 -07:00
tmpfs: add shmem_read_mapping_page_gfp
2011-06-27 18:00:12 -07:00
superblock: introduce per-sb cache shrinker infrastructure
2011-07-20 20:47:10 -04:00
net: introduce __netdev_alloc_skb_ip_align
2011-07-11 20:08:34 -07:00
slab allocators: Provide generic description of alignment defines
2011-07-07 21:04:12 +03:00
slab: shrink sizeof(struct kmem_cache)
2011-07-20 20:27:56 +03:00
slab, slub, slob: Unify alignment definition
2011-06-16 19:40:20 +03:00
slub: Add method to verify memory is not freed
2011-07-07 22:17:08 +03:00
generic-ipi: Fix kexec boot crash by initializing call_single_queue before enabling interrupts
2011-06-17 10:17:12 +02:00
NFC: add NFC socket family
2011-07-05 15:26:58 -04:00
x86: Swap save_stack_trace_regs parameters
2011-06-14 22:48:51 -04:00
stmmac: unify MAC and PHY configuration parameters (V2)
2011-07-21 15:29:16 -07:00
x86, mtrr: use stop_machine APIs for doing MTRR rendezvous
2011-06-27 15:17:13 -07:00
PM / Suspend: Add .suspend_again() callback to suspend_ops
2011-07-15 23:58:19 +02:00
mm: move shmem prototypes to shmem_fs.h
2011-06-27 18:00:12 -07:00
swiotlb: Export swioltb_nr_tbl and utilize it as appropiate.
2011-06-06 15:41:16 -04:00
Delay struct net freeing while there's a sysfs instance refering to it
2011-06-12 17:45:41 -04:00
tcp: RFC2988bis + taking RTT sample from 3WHS for the passive open side
2011-06-08 17:05:30 -07:00
mm: increase RECLAIM_DISTANCE to 30
2011-06-15 20:03:59 -07:00
kill tracehook_notify_death()
2011-06-27 20:30:08 +02:00
Revert "tty: make receive_buf() return the amout of bytes received"
2011-06-04 06:33:24 +09:00
usb-storage: redo incorrect reads
2011-06-07 09:05:42 -07:00
uts: make default hostname configurable, rather than always using "(none)"
2011-06-15 20:04:00 -07:00
virtio: add api for delayed callbacks
2011-05-30 11:14:16 +09:30
virtio: add full three-clause BSD text to headers.
2011-05-30 11:14:14 +09:30
virtio: add full three-clause BSD text to headers.
2011-05-30 11:14:14 +09:30
virtio: add full three-clause BSD text to headers.
2011-05-30 11:14:14 +09:30
virtio: add full three-clause BSD text to headers.
2011-05-30 11:14:14 +09:30
virtio: add full three-clause BSD text to headers.
2011-05-30 11:14:14 +09:30
virtio: add full three-clause BSD text to headers.
2011-05-30 11:14:14 +09:30
virtio_net: introduce VIRTIO_NET_HDR_F_DATA_VALID
2011-06-11 15:57:47 -07:00
virtio: add full three-clause BSD text to headers.
2011-05-30 11:14:14 +09:30
virtio ring: inline function to check for events
2011-05-30 11:14:14 +09:30
