• Mike Kravetz's avatar
    hugetlbfs: Use i_mmap_rwsem to fix page fault/truncate race · c86aa7bb
    Mike Kravetz authored
    hugetlbfs page faults can race with truncate and hole punch operations.
    Current code in the page fault path attempts to handle this by 'backing
    out' operations if we encounter the race.  One obvious omission in the
    current code is removing a page newly added to the page cache.  This is
    pretty straight forward to address, but there is a more subtle and
    difficult issue of backing out hugetlb reservations.  To handle this
    correctly, the 'reservation state' before page allocation needs to be
    noted so that it can be properly backed out.  There are four distinct
    possibilities for reservation state: shared/reserved, shared/no-resv,
    private/reserved and private/no-resv.  Backing out a reservation may
    require memory allocation which could fail so that needs to be taken into
    account as well.
    Instead of writing the required complicated code for this rare occurrence,
    just eliminate the race.  i_mmap_rwsem is now held in read mode for the
    duration of page fault processing.  Hold i_mmap_rwsem longer in truncation
    and hold punch code to cover the call to remove_inode_hugepages.
    With this modification, code in remove_inode_hugepages checking for races
    becomes 'dead' as it can not longer happen.  Remove the dead code and
    expand comments to explain reasoning.  Similarly, checks for races with
    truncation in the page fault path can be simplified and removed.
    [mike.kravetz@oracle.com: incorporat suggestions from Kirill]
      Link: http://lkml.kernel.org/r/20181222223013.22193-3-mike.kravetz@oracle.com
    Link: http://lkml.kernel.org/r/20181218223557.5202-3-mike.kravetz@oracle.com
    Fixes: ebed4bfc ("hugetlb: fix absurd HugePages_Rsvd")
    Signed-off-by: default avatarMike Kravetz <mike.kravetz@oracle.com>
    Acked-by: default avatarKirill A. Shutemov <kirill.shutemov@linux.intel.com>
    Cc: Michal Hocko <mhocko@kernel.org>
    Cc: Hugh Dickins <hughd@google.com>
    Cc: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
    Cc: "Aneesh Kumar K . V" <aneesh.kumar@linux.vnet.ibm.com>
    Cc: Andrea Arcangeli <aarcange@redhat.com>
    Cc: Davidlohr Bueso <dave@stgolabs.net>
    Cc: Prakash Sangappa <prakash.sangappa@oracle.com>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
    Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
hugetlb.c 134 KB