Skip to content

Commit e7908f7

Browse files
Carsten Ottegregkh
Carsten Otte
authored andcommitted
mm/filemap_xip.c: fix race condition in xip_file_fault()
commit 99f02ef upstream. Fix a race condition that shows in conjunction with xip_file_fault() when two threads of the same user process fault on the same memory page. In this case, the race winner will install the page table entry and the unlucky loser will cause an oops: xip_file_fault calls vm_insert_pfn (via vm_insert_mixed) which drops out at this check: retval = -EBUSY; if (!pte_none(*pte)) goto out_unlock; The resulting -EBUSY return value will trigger a BUG_ON() in xip_file_fault. This fix simply considers the fault as fixed in this case, because the race winner has successfully installed the pte. [[email protected]: use conventional (and consistent) comment layout] Reported-by: David Sadler <[email protected]> Signed-off-by: Carsten Otte <[email protected]> Reported-by: Louis Alex Eisner <[email protected]> Cc: Hugh Dickins <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
1 parent 2139363 commit e7908f7

File tree

1 file changed

+6
-1
lines changed

1 file changed

+6
-1
lines changed

mm/filemap_xip.c

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -263,7 +263,12 @@ static int xip_file_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
263263
xip_pfn);
264264
if (err == -ENOMEM)
265265
return VM_FAULT_OOM;
266-
BUG_ON(err);
266+
/*
267+
* err == -EBUSY is fine, we've raced against another thread
268+
* that faulted-in the same page
269+
*/
270+
if (err != -EBUSY)
271+
BUG_ON(err);
267272
return VM_FAULT_NOPAGE;
268273
} else {
269274
int err, ret = VM_FAULT_OOM;

0 commit comments

Comments
 (0)