Benjamin Herrenschmidt
2efaca927f
mm/futex: fix futex writes on archs with SW tracking of dirty & young ...
I haven't reproduced it myself but the fail scenario is that on such
machines (notably ARM and some embedded powerpc), if you manage to hit
that futex path on a writable page whose dirty bit has gone from the PTE,
you'll livelock inside the kernel from what I can tell.
It will go in a loop of trying the atomic access, failing, trying gup to
"fix it up", getting succcess from gup, go back to the atomic access,
failing again because dirty wasn't fixed etc...
So I think you essentially hang in the kernel.
The scenario is probably rare'ish because affected architecture are
embedded and tend to not swap much (if at all) so we probably rarely hit
the case where dirty is missing or young is missing, but I think Shan has
a piece of SW that can reliably reproduce it using a shared writable
mapping & fork or something like that.
On archs who use SW tracking of dirty & young, a page without dirty is
effectively mapped read-only and a page without young unaccessible in the
PTE.
Additionally, some architectures might lazily flush the TLB when relaxing
write protection (by doing only a local flush), and expect a fault to
invalidate the stale entry if it's still present on another processor.
The futex code assumes that if the "in_atomic()" access -EFAULT's, it can
"fix it up" by causing get_user_pages() which would then be equivalent to
taking the fault.
However that isn't the case. get_user_pages() will not call
handle_mm_fault() in the case where the PTE seems to have the right
permissions, regardless of the dirty and young state. It will eventually
update those bits ... in the struct page, but not in the PTE.
Additionally, it will not handle the lazy TLB flushing that can be
required by some architectures in the fault case.
Basically, gup is the wrong interface for the job. The patch provides a
more appropriate one which boils down to just calling handle_mm_fault()
since what we are trying to do is simulate a real page fault.
The futex code currently attempts to write to user memory within a
pagefault disabled section, and if that fails, tries to fix it up using
get_user_pages().
This doesn't work on archs where the dirty and young bits are maintained
by software, since they will gate access permission in the TLB, and will
not be updated by gup().
In addition, there's an expectation on some archs that a spurious write
fault triggers a local TLB flush, and that is missing from the picture as
well.
I decided that adding those "features" to gup() would be too much for this
already too complex function, and instead added a new simpler
fixup_user_fault() which is essentially a wrapper around handle_mm_fault()
which the futex code can call.
[akpm@linux-foundation.org: coding-style fixes]
[akpm@linux-foundation.org: fix some nits Darren saw, fiddle comment layout]
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Reported-by: Shan Hai <haishan.bai@gmail.com>
Tested-by: Shan Hai <haishan.bai@gmail.com>
Cc: David Laight <David.Laight@ACULAB.COM>
Acked-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: Darren Hart <darren.hart@intel.com>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2011-07-25 20:57:11 -07:00
Fix common misspellings
2011-03-31 11:26:23 -03:00
perf: Remove perf_event_attr::type check
2011-07-21 20:41:55 +02:00
gcov: disable CONFIG_CONSTRUCTORS when not needed by CONFIG_GCOV_KERNEL
2011-06-15 20:04:01 -07:00
genirq: replace irq_gc_ack() with {set,clr}_bit variants (fwd)
2011-07-07 16:02:26 +00:00
Merge branch 'pm-domains' into for-linus
2011-07-15 23:59:09 +02:00
Merge branch 'timers-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip
2011-07-22 16:52:18 -07:00
Merge branch 'tip/perf/core' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-2.6-trace into perf/core
2011-07-21 09:32:40 +02:00
pass a struct path to vfs_statfs
2010-08-09 16:48:42 -04:00
async: Fixed an include coding style issue
2011-06-14 22:48:46 -04:00
netfilter: add SELinux context support to AUDIT target
2011-06-30 13:31:57 +02:00
audit: make functions static
2010-10-30 01:42:19 -04:00
audit_tree,rcu: Convert call_rcu(__put_tree) to kfree_rcu()
2011-07-20 14:10:11 -07:00
kill path_lookup()
2011-03-14 09:15:23 -04:00
netlink: kill loginuid/sessionid/sid members from struct netlink_skb_parms
2011-03-03 10:55:40 -08:00
audit: acquire creds selectively to reduce atomic op overhead
2011-04-27 15:11:03 +02:00
memcg: remove direct page_cgroup-to-page pointer
2011-03-23 19:46:28 -07:00
Merge branch 'master' into next
2011-05-19 18:51:57 +10:00
kill file_permission() completely
2011-07-20 01:43:11 -04:00
cgroups: add per-thread subsystem callbacks
2011-05-26 17:12:34 -07:00
KVM: Add compat ioctl for KVM_SET_SIGNAL_MASK
2011-07-12 13:16:17 +03:00
llseek: automatically add .llseek fop
2010-10-15 15:53:27 +02:00
Fix common misspellings
2011-03-31 11:26:23 -03:00
cpuset: Fix cpuset_cpus_allowed_fallback(), don't update tsk->rt.nr_cpus_allowed
2011-05-28 17:02:57 +02:00
crash_dump: export is_kdump_kernel to modules, consolidate elfcorehdr_addr, setup_elfcorehdr and saved_max_pfn
2011-03-23 19:47:19 -07:00
Merge branch 'docs-move' of git://git.kernel.org/pub/scm/linux/kernel/git/rdunlap/linux-docs
2011-05-27 10:25:02 -07:00
KVM: Steal time implementation
2011-07-14 12:59:14 +03:00
sys_personality: remove the bogus checks in sys_personality()->__set_personality() path
2010-08-09 20:45:05 -07:00
Merge branch 'ptrace' of git://git.kernel.org/pub/scm/linux/kernel/git/oleg/misc
2011-07-22 15:06:50 -07:00
extable, core_kernel_data(): Make sure all archs define _sdata
2011-05-20 08:56:56 +02:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6
2011-07-22 19:02:39 -07:00
Freezer: Use SMP barriers
2011-05-17 23:19:17 +02:00
mm/futex: fix futex writes on archs with SW tracking of dirty & young
2011-07-25 20:57:11 -07:00
userns: user namespaces: convert several capable() calls
2011-03-23 19:47:08 -07:00
userns: user namespaces: convert several capable() calls
2011-03-23 19:47:08 -07:00
hrtimers: Fix typo causing erratic timers
2011-05-25 15:31:58 -07:00
watchdog, hung_task_timeout: Add Kconfig configurable default
2011-04-28 09:13:17 +02:00
irq_work: Use per cpu atomics instead of regular atomics
2010-12-18 15:54:48 +01:00
jump_label: Fix jump_label update for modules
2011-06-29 09:59:17 -04:00
Merge branch 'core-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip
2011-03-25 17:52:22 -07:00
arch:Kconfig.locks Remove unused config option.
2011-04-10 17:01:05 +02:00
sched: Isolate preempt counting in its own config option
2011-06-10 15:15:40 +02:00
PM: Remove sysdev suspend, resume and shutdown operations
2011-05-11 21:37:15 +02:00
kfifo: fix scatterlist usage
2010-10-01 10:50:58 -07:00
KEYS/DNS: Fix ____call_usermodehelper() to not lose the session keyring
2011-06-17 09:40:48 -07:00
kprobes: Return -ENOENT if probe point doesn't exist
2011-07-15 15:11:47 -04:00
kernel/ksysfs.c: expose file_caps_enabled in sysfs
2011-04-19 16:45:51 -07:00
cpuset: Fix cpuset_cpus_allowed_fallback(), don't update tsk->rt.nr_cpus_allowed
2011-05-28 17:02:57 +02:00
Fix common misspellings
2011-03-31 11:26:23 -03:00
Merge branch 'core-printk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip
2011-07-22 16:43:49 -07:00
lockdep: Remove unused 'factor' variable from lockdep_stats_show()
2011-03-23 13:54:47 +01:00
cgroup: remove the ns_cgroup
2011-05-26 17:12:34 -07:00
module: add /sys/module/<name>/uevent files
2011-07-24 22:06:04 +09:30
mutex: Use p->on_cpu for the adaptive spin
2011-04-14 08:52:33 +02:00
mutex: Use p->on_cpu for the adaptive spin
2011-04-14 08:52:33 +02:00
lockdep, mutex: provide mutex_lock_nest_lock
2011-05-25 08:39:17 -07:00
mutex: Use p->on_cpu for the adaptive spin
2011-04-14 08:52:33 +02:00
make sure that nsproxy_cache is initialized early enough
2011-07-20 01:44:07 -04:00
Fix common misspellings
2011-03-31 11:26:23 -03:00
move x86 specific oops=panic to generic code
2011-03-22 17:44:11 -07:00
module: add /sys/module/<name>/uevent files
2011-07-24 22:06:04 +09:30
next_pidmap: fix overflow condition
2011-04-18 10:35:30 -07:00
pidns: call pid_ns_prepare_proc() from create_pid_namespace()
2011-03-23 19:46:58 -07:00
plist: Remove the need to supply locks to plist heads
2011-07-08 14:02:53 +02:00
hrtimers: Avoid touching inactive timer bases
2011-05-23 13:59:54 +02:00
posix-timers: RCU conversion
2011-05-24 12:10:51 +02:00
printk: Fix console_sem vs logbuf_lock unlock race
2011-06-22 11:39:34 +02:00
kernel/profile.c: remove some duplicate code from profile_hits()
2011-05-26 17:12:37 -07:00
connector: add an event for monitoring process tracers
2011-07-18 21:38:33 +02:00
kernel/range.c: fix clean_sort_range() for the case of full array
2010-11-12 07:55:31 -08:00
rcu: Use WARN_ON_ONCE for DEBUG_OBJECTS_RCU_HEAD warnings
2011-05-05 23:16:57 -07:00
sanitize <linux/prefetch.h> usage
2011-05-20 12:50:29 -07:00
rcu: Converge TINY_RCU expedited and normal boosting
2011-05-05 23:16:58 -07:00
rcu: mark rcutorture boosting callback as being on-stack
2011-05-05 23:16:57 -07:00
rcu: Prevent RCU callbacks from executing before scheduler initialized
2011-07-13 08:17:56 -07:00
rcu: Move RCU_BOOST #ifdefs to header file
2011-06-16 16:12:05 -07:00
softirq,rcu: Inform RCU of irq_exit() activity
2011-07-20 10:50:12 -07:00
rcu: use softirq instead of kthreads except when RCU_BOOST=y
2011-06-15 23:07:21 -07:00
Clean up relay_alloc_page_array() slightly by using vzalloc rather than vmalloc and memset
2010-11-05 08:21:34 -07:00
memcg: res_counter_read_u64(): fix potential races on 32-bit machines
2011-03-23 19:46:22 -07:00
resource: ability to resize an allocated resource
2011-07-06 10:54:08 -07:00
rtmutex: Simplify PI algorithm and make highest prio task get lock
2011-01-27 21:13:51 -05:00
rtmutex: tester: Remove the remaining BKL leftovers
2011-02-22 22:07:22 +01:00
plist: Remove the need to supply locks to plist heads
2011-07-08 14:02:53 +02:00
rtmutex: Simplify PI algorithm and make highest prio task get lock
2011-01-27 21:13:51 -05:00
rw_semaphore: remove up/down_read_non_owner
2011-07-20 20:47:47 -04:00
Merge branch 'kvm-updates/3.1' of git://git.kernel.org/pub/scm/virt/kvm/kvm
2011-07-24 09:07:03 -07:00
Fix common misspellings
2011-03-31 11:26:23 -03:00
sched: Skip autogroup when looking for all rt sched groups
2011-07-01 10:39:08 +02:00
sched: Add some clock info to sched_debug
2010-11-23 10:29:08 +01:00
sched: Get rid of lock_depth
2011-04-24 13:18:38 +02:00
sched: Cleanup duplicate local variable in [enqueue|dequeue]_task_fair
2011-07-22 12:47:22 +02:00
Merge branch 'kvm-updates/3.1' of git://git.kernel.org/pub/scm/virt/kvm/kvm
2011-07-24 09:07:03 -07:00
sched: Drop the rq argument to sched_class::select_task_rq()
2011-04-14 08:52:36 +02:00
sched: Skip autogroup when looking for all rt sched groups
2011-07-01 10:39:08 +02:00
sched: More sched_domain iterations fixes
2011-05-28 17:02:54 +02:00
sched: Drop the rq argument to sched_class::select_task_rq()
2011-04-14 08:52:36 +02:00
Merge branch 'ptrace' of git://git.kernel.org/pub/scm/linux/kernel/git/oleg/misc
2011-07-22 15:06:50 -07:00
generic-ipi: Fix kexec boot crash by initializing call_single_queue before enabling interrupts
2011-06-17 10:17:12 +02:00
softirq,rcu: Inform RCU of irq_exit() activity
2011-07-20 10:50:12 -07:00
rcu: demote SRCU_SYNCHRONIZE_DELAY from kernel-parameter status
2011-01-14 04:56:49 -08:00
stack_trace: Add weak save_stack_trace_regs()
2011-06-14 22:48:52 -04:00
x86, mtrr: use stop_machine APIs for doing MTRR rendezvous
2011-06-27 15:17:13 -07:00
Merge branch 'driver-core-next' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core-2.6
2011-05-19 18:24:11 -07:00
ipc: Add missing sys_ni entries for ipc/compat.c functions
2011-05-20 13:53:02 -07:00
sysctl,rcu: Convert call_rcu(free_head) to kfree
2011-07-20 14:10:18 -07:00
open-style analog of vfs_path_lookup()
2011-03-14 09:15:28 -04:00
sysctl_check: drop dead code
2011-03-23 19:46:51 -07:00
taskstats: don't allow duplicate entries in listener mode
2011-06-27 18:00:13 -07:00
kprobes: Fix selftest to clear flags field for reusing probes
2010-10-14 08:55:27 +02:00
Merge branch 'timers-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip
2011-03-15 18:53:35 -07:00
timers: Consider slack value in mod_timer()
2011-06-03 15:02:32 +02:00
jump label: Introduce static_branch() interface
2011-04-04 12:48:08 -04:00
taskstats: use real microsecond granularity for CPU times
2010-10-27 18:03:17 -07:00
userns: user namespaces: convert several capable() calls
2011-03-23 19:47:08 -07:00
Fix common misspellings
2011-03-31 11:26:23 -03:00
userns: add a user_namespace as creator/owner of uts_namespace
2011-03-23 19:46:59 -07:00
user_ns: improve the user_ns on-the-slab packaging
2011-01-13 08:03:18 -08:00
ns proc: Add support for the uts namespace
2011-05-10 14:35:35 -07:00
Fix common misspellings
2011-03-31 11:26:23 -03:00
perf, x86: P4 PMU - Introduce event alias feature
2011-07-14 17:25:04 -04:00
Merge branch 'for-3.1' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq
2011-07-22 15:07:15 -07:00
2efaca927f