From patchwork Wed Apr 30 06:06:06 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: hujianyang X-Patchwork-Id: 344060 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.9]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 90C0D14007F for ; Wed, 30 Apr 2014 16:08:55 +1000 (EST) Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.80.1 #2 (Red Hat Linux)) id 1WfNfp-0007xw-4e; Wed, 30 Apr 2014 06:07:17 +0000 Received: from szxga03-in.huawei.com ([119.145.14.66]) by bombadil.infradead.org with esmtps (Exim 4.80.1 #2 (Red Hat Linux)) id 1WfNfk-0007Zc-OY for linux-mtd@lists.infradead.org; Wed, 30 Apr 2014 06:07:13 +0000 Received: from 172.24.2.119 (EHLO szxeml214-edg.china.huawei.com) ([172.24.2.119]) by szxrg03-dlp.huawei.com (MOS 4.4.3-GA FastPath queued) with ESMTP id AOC10061; Wed, 30 Apr 2014 14:06:19 +0800 (CST) Received: from SZXEML450-HUB.china.huawei.com (10.82.67.193) by szxeml214-edg.china.huawei.com (172.24.2.29) with Microsoft SMTP Server (TLS) id 14.3.158.1; Wed, 30 Apr 2014 14:06:17 +0800 Received: from [127.0.0.1] (10.111.68.144) by szxeml450-hub.china.huawei.com (10.82.67.193) with Microsoft SMTP Server id 14.3.158.1; Wed, 30 Apr 2014 14:06:09 +0800 Message-ID: <536092CE.2090209@huawei.com> Date: Wed, 30 Apr 2014 14:06:06 +0800 From: hujianyang User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:17.0) Gecko/20130801 Thunderbird/17.0.8 MIME-Version: 1.0 To: Artem Bityutskiy , Subject: [PATCH v2] UBIFS: Fix assert failed in ubifs_set_page_dirty References: <535B7B96.9030008@huawei.com> In-Reply-To: <535B7B96.9030008@huawei.com> X-Originating-IP: [10.111.68.144] X-CFilter-Loop: Reflected X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20140429_230713_162655_5D95797C X-CRM114-Status: UNSURE ( 7.67 ) X-CRM114-Notice: Please train this message. X-Spam-Score: -1.4 (-) X-Spam-Report: SpamAssassin version 3.3.2 on bombadil.infradead.org summary: Content analysis details: (-1.4 points) pts rule name description ---- ---------------------- -------------------------------------------------- -0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at http://www.dnswl.org/, low trust [119.145.14.66 listed in list.dnswl.org] -0.7 RP_MATCHES_RCVD Envelope sender domain matches handover relay domain -0.0 SPF_PASS SPF: sender matches SPF record Cc: Laurence Withers , linux-mtd X-BeenThere: linux-mtd@lists.infradead.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Linux MTD discussion mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-mtd" Errors-To: linux-mtd-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org Hi, all Basing on the perious mail, I would like to show a clear figure about the race I have found. Thread A (mmap) Thread B (fsync) ->__do_fault ->write_cache_pages -> ubifs_page_mkwrite -> budget_space -> lock_page -> release/convert_page_budget -> SetPagePrivate -> TestSetPageDirty -> unlock_page -> lock_page -> TestClearPageDirty -> ubifs_writepage -> do_writepage -> release_budget -> ClearPagePrivate -> unlock_page -> !(ret & VM_FAULT_LOCKED) -> lock_page -> set_page_dirty -> ubifs_set_page_dirty -> TestSetPageDirty (set page dirty without budgeting) -> unlock_page According to this situation, my v2 fix returns from page_mkwrite without performing unlock_page. We return VM_FAULT_LOCKED instead of just return 0. After doing this, the race above will not happen. Signed-off-by: hujianyang Tested-by: Laurence Withers --- fs/ubifs/file.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/fs/ubifs/file.c b/fs/ubifs/file.c index 4f34dba..f7d48a0 100644 --- a/fs/ubifs/file.c +++ b/fs/ubifs/file.c @@ -1525,8 +1525,7 @@ static int ubifs_vm_page_mkwrite(struct vm_area_struct *vma, } wait_for_stable_page(page); - unlock_page(page); - return 0; + return VM_FAULT_LOCKED; out_unlock: unlock_page(page);