| From 691a7c6f28ac90cccd0dbcf81348ea90b211bdd0 Mon Sep 17 00:00:00 2001 |
| From: hujianyang <hujianyang@huawei.com> |
| Date: Wed, 30 Apr 2014 14:06:06 +0800 |
| Subject: UBIFS: fix an mmap and fsync race condition |
| |
| From: hujianyang <hujianyang@huawei.com> |
| |
| commit 691a7c6f28ac90cccd0dbcf81348ea90b211bdd0 upstream. |
| |
| There is a race condition in UBIFS: |
| |
| Thread A (mmap) Thread B (fsync) |
| |
| ->__do_fault ->write_cache_pages |
| -> ubifs_vm_page_mkwrite |
| -> budget_space |
| -> lock_page |
| -> release/convert_page_budget |
| -> SetPagePrivate |
| -> TestSetPageDirty |
| -> unlock_page |
| -> lock_page |
| -> TestClearPageDirty |
| -> ubifs_writepage |
| -> do_writepage |
| -> release_budget |
| -> ClearPagePrivate |
| -> unlock_page |
| -> !(ret & VM_FAULT_LOCKED) |
| -> lock_page |
| -> set_page_dirty |
| -> ubifs_set_page_dirty |
| -> TestSetPageDirty (set page dirty without budgeting) |
| -> unlock_page |
| |
| This leads to situation where we have a diry page but no budget allocated for |
| this page, so further write-back may fail with -ENOSPC. |
| |
| In this fix we return from page_mkwrite without performing unlock_page. We |
| return VM_FAULT_LOCKED instead. After doing this, the race above will not |
| happen. |
| |
| Signed-off-by: hujianyang <hujianyang@huawei.com> |
| Tested-by: Laurence Withers <lwithers@guralp.com> |
| Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| fs/ubifs/file.c | 3 +-- |
| 1 file changed, 1 insertion(+), 2 deletions(-) |
| |
| --- a/fs/ubifs/file.c |
| +++ b/fs/ubifs/file.c |
| @@ -1525,8 +1525,7 @@ static int ubifs_vm_page_mkwrite(struct |
| } |
| |
| wait_for_stable_page(page); |
| - unlock_page(page); |
| - return 0; |
| + return VM_FAULT_LOCKED; |
| |
| out_unlock: |
| unlock_page(page); |
