• Naoya Horiguchi's avatar
    mm/hugetlb: fix getting refcount 0 page in hugetlb_fault() · 0f792cf9
    Naoya Horiguchi authored
    When running the test which causes the race as shown in the previous patch,
    we can hit the BUG "get_page() on refcount 0 page" in hugetlb_fault().
    
    This race happens when pte turns into migration entry just after the first
    check of is_hugetlb_entry_migration() in hugetlb_fault() passed with false.
    To fix this, we need to check pte_present() again after huge_ptep_get().
    
    This patch also reorders taking ptl and doing pte_page(), because
    pte_page() should be done in ptl.  Due to this reordering, we need use
    trylock_page() in page != pagecache_page case to respect locking order.
    
    Fixes: 66aebce7 ("hugetlb: fix race condition in hugetlb_fault()")
    Signed-off-by: default avatarNaoya Horiguchi <n-horiguchi@ah.jp.nec.com>
    Cc: Hugh Dickins <hughd@google.com>
    Cc: James Hogan <james.hogan@imgtec.com>
    Cc: David Rientjes <rientjes@google.com>
    Cc: Mel Gorman <mel@csn.ul.ie>
    Cc: Johannes Weiner <hannes@cmpxchg.org>
    Cc: Michal Hocko <mhocko@suse.cz>
    Cc: Rik van Riel <riel@redhat.com>
    Cc: Andrea Arcangeli <aarcange@redhat.com>
    Cc: Luiz Capitulino <lcapitulino@redhat.com>
    Cc: Nishanth Aravamudan <nacc@linux.vnet.ibm.com>
    Cc: Lee Schermerhorn <lee.schermerhorn@hp.com>
    Cc: Steve Capper <steve.capper@linaro.org>
    Cc: <stable@vger.kernel.org>	[3.2+]
    Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
    Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    0f792cf9
hugetlb.c 99.4 KB