Commit fe19bd3d authored by Hugh Dickins's avatar Hugh Dickins Committed by Linus Torvalds
Browse files

mm, futex: fix shared futex pgoff on shmem huge page 

If more than one futex is placed on a shmem huge page, it can happen
that waking the second wakes the first instead, and leaves the second
waiting: the key's shared.pgoff is wrong.

When 3.11 commit 13d60f4b ("futex: Take hugepages into account when
generating futex_key"), the only shared huge pages came from hugetlbfs,
and the code added to deal with its exceptional page->index was put into
hugetlb source.  Then that was missed when 4.8 added shmem huge pages.

page_to_pgoff() is what others use for this nowadays: except that, as
currently written, it gives the right answer on hugetlbfs head, but
nonsense on hugetlbfs tails.  Fix that by calling hugetlbfs-specific
hugetlb_basepage_index() on PageHuge tails as well as on head.

Yes, it's unconventional to declare hugetlb_basepage_index() there in
pagemap.h, rather than in hugetlb.h; but I do not expect anything but
page_to_pgoff() ever to need it.

[akpm@linux-foundation.org: give hugetlb_basepage_index() prototype the correct scope]

Link: https://lkml.kernel.org/r/b17d946b-d09-326e-b42a-52884c36df32@google.com


Fixes: 800d8c63 ("shmem: add huge pages support")
Reported-by: default avatarNeel Natu <neelnatu@google.com>
Signed-off-by: default avatarHugh Dickins <hughd@google.com>
Reviewed-by: default avatarMatthew Wilcox (Oracle) <willy@infradead.org>
Acked-by: default avatarThomas Gleixner <tglx@linutronix.de>
Cc: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
Cc: Zhang Yi <wetpzy@gmail.com>
Cc: Mel Gorman <mgorman@techsingularity.net>
Cc: Mike Kravetz <mike.kravetz@oracle.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Darren Hart <dvhart@infradead.org>
Cc: Davidlohr Bueso <dave@stgolabs.net>
Cc: <stable@vger.kernel.org>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 5fa54346

include/linux/hugetlb.h

+0 −16
Original line number Diff line number Diff line
@@ -741,17 +741,6 @@ static inline int hstate_index(struct hstate *h) 
	return h - hstates;

}



pgoff_t __basepage_index(struct page *page);



/* Return page->index in PAGE_SIZE units */

static inline pgoff_t basepage_index(struct page *page)

{

	if (!PageCompound(page))

		return page->index;



	return __basepage_index(page);

}



extern int dissolve_free_huge_page(struct page *page);

extern int dissolve_free_huge_pages(unsigned long start_pfn,

				    unsigned long end_pfn);
@@ -988,11 +977,6 @@ static inline int hstate_index(struct hstate *h) 
	return 0;

}



static inline pgoff_t basepage_index(struct page *page)

{

	return page->index;

}



static inline int dissolve_free_huge_page(struct page *page)

{

	return 0;

include/linux/pagemap.h

+7 −6
Original line number Diff line number Diff line
@@ -516,7 +516,7 @@ static inline struct page *read_mapping_page(struct address_space *mapping, 
}



/*

 * Get index of the page with in radix-tree

 * Get index of the page within radix-tree (but not for hugetlb pages).

 * (TODO: remove once hugetlb pages will have ->index in PAGE_SIZE)

 */

static inline pgoff_t page_to_index(struct page *page)
@@ -535,15 +535,16 @@ static inline pgoff_t page_to_index(struct page *page) 
	return pgoff;

}



extern pgoff_t hugetlb_basepage_index(struct page *page);



/*

 * Get the offset in PAGE_SIZE.

 * (TODO: hugepage should have ->index in PAGE_SIZE)

 * Get the offset in PAGE_SIZE (even for hugetlb pages).

 * (TODO: hugetlb pages should have ->index in PAGE_SIZE)

 */

static inline pgoff_t page_to_pgoff(struct page *page)

{

	if (unlikely(PageHeadHuge(page)))

		return page->index << compound_order(page);



	if (unlikely(PageHuge(page)))

		return hugetlb_basepage_index(page);

	return page_to_index(page);

}

kernel/futex.c

+1 −2
Original line number Diff line number Diff line
@@ -35,7 +35,6 @@ 
#include <linux/jhash.h>

#include <linux/pagemap.h>

#include <linux/syscalls.h>

#include <linux/hugetlb.h>

#include <linux/freezer.h>

#include <linux/memblock.h>

#include <linux/fault-inject.h>
@@ -650,7 +649,7 @@ static int get_futex_key(u32 __user *uaddr, bool fshared, union futex_key *key, 


		key->both.offset |= FUT_OFF_INODE; /* inode-based key */

		key->shared.i_seq = get_inode_sequence_number(inode);

		key->shared.pgoff = basepage_index(tail);

		key->shared.pgoff = page_to_pgoff(tail);

		rcu_read_unlock();

	}

mm/hugetlb.c

+1 −4
Original line number Diff line number Diff line
@@ -1588,15 +1588,12 @@ struct address_space *hugetlb_page_mapping_lock_write(struct page *hpage) 
	return NULL;

}



pgoff_t __basepage_index(struct page *page)

pgoff_t hugetlb_basepage_index(struct page *page)

{

	struct page *page_head = compound_head(page);

	pgoff_t index = page_index(page_head);

	unsigned long compound_idx;



	if (!PageHuge(page_head))

		return page_index(page);



	if (compound_order(page_head) >= MAX_ORDER)

		compound_idx = page_to_pfn(page) - page_to_pfn(page_head);

	else