diff options
| author | hujianyang <hujianyang@huawei.com> | 2014-04-30 14:06:06 +0800 |
|---|---|---|
| committer | Ben Hutchings <ben@decadent.org.uk> | 2014-07-11 13:33:34 +0100 |
| commit | 2e87c9895d55ef1df895b766d207f52da391680e (patch) | |
| tree | 312d203a7613cdfb3e8512ad8734c0e392d4cf0a /fs | |
| parent | 00ff92c2da9ed2bba1f1df324129e7767eeda63a (diff) | |
UBIFS: fix an mmap and fsync race condition
commit 691a7c6f28ac90cccd0dbcf81348ea90b211bdd0 upstream.
There is a race condition in UBIFS:
Thread A (mmap) Thread B (fsync)
->__do_fault ->write_cache_pages
-> ubifs_vm_page_mkwrite
-> budget_space
-> lock_page
-> release/convert_page_budget
-> SetPagePrivate
-> TestSetPageDirty
-> unlock_page
-> lock_page
-> TestClearPageDirty
-> ubifs_writepage
-> do_writepage
-> release_budget
-> ClearPagePrivate
-> unlock_page
-> !(ret & VM_FAULT_LOCKED)
-> lock_page
-> set_page_dirty
-> ubifs_set_page_dirty
-> TestSetPageDirty (set page dirty without budgeting)
-> unlock_page
This leads to situation where we have a diry page but no budget allocated for
this page, so further write-back may fail with -ENOSPC.
In this fix we return from page_mkwrite without performing unlock_page. We
return VM_FAULT_LOCKED instead. After doing this, the race above will not
happen.
Signed-off-by: hujianyang <hujianyang@huawei.com>
Tested-by: Laurence Withers <lwithers@guralp.com>
Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Diffstat (limited to 'fs')
| -rw-r--r-- | fs/ubifs/file.c | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/fs/ubifs/file.c b/fs/ubifs/file.c index f9c234bf33d3..6589006aa6f4 100644 --- a/fs/ubifs/file.c +++ b/fs/ubifs/file.c @@ -1522,8 +1522,7 @@ static int ubifs_vm_page_mkwrite(struct vm_area_struct *vma, ubifs_release_dirty_inode_budget(c, ui); } - unlock_page(page); - return 0; + return VM_FAULT_LOCKED; out_unlock: unlock_page(page); |