[Devel] [PATCH RHEL7 COMMIT] mm/tcache: close race between attach and invalidate page

[Konstantin Khorenko]

The commit is pushed to "branch-rh7-3.10.0-514.10.2.vz7.29.x-ovz" and will appear at https://src.openvz.org/scm/ovz/vzkernel.git
after rh7-3.10.0-514.10.2.vz7.29.13
------>
commit 7551b5c4ae61988369226c24b83717f0d3ef5aef
Author: Andrey Ryabinin <aryabinin at virtuozzo.com>
Date:   Fri Apr 7 16:23:07 2017 +0400

    mm/tcache: close race between attach and invalidate page
    
    Currently the following race between page attach and invalidate page
    could result in crashes:
    
                CPU1                                      CPU2
     tcache_cleancache_put_page();
        tcache_attach_page();
           tcache_page_tree_replace();
                                                  tcache_invalidate_node_pages();
    						page = radix_tree_deref_slot_protected();
                                                    __tcache_page_tree_delete(page);
                                                    tcache_lru_del(page);
                                                    tcache_put_page(page);  <-- this frees the page
            ...
            tcache_hold_page(page); // page may freed at this point
            tcache_lru_add(node->pool, page);
    
    To prevent this, protect with node->tree_lock not only insertion to radix
    tree, but also tcache_hold_page() and addition to the lru list.
    So if we extract the page from radix_tree now we can be sure that
    it is already on lru list and page refcounter increased.
    
    https://jira.sw.ru/browse/PSBM-63197
    
    Signed-off-by: Andrey Ryabinin <aryabinin at virtuozzo.com>
---
 mm/tcache.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/mm/tcache.c b/mm/tcache.c
index c7613b2..e15d212 100644
--- a/mm/tcache.c
+++ b/mm/tcache.c
@@ -724,7 +724,6 @@ static int tcache_page_tree_replace(struct tcache_node *node, pgoff_t index,
 
 	*old_page = NULL;
 
-	spin_lock(&node->tree_lock);
 	/*
 	 * If the node was invalidated after we looked it up, abort in order to
 	 * avoid clashes with tcache_invalidate_node_pages.
@@ -752,7 +751,6 @@ static int tcache_page_tree_replace(struct tcache_node *node, pgoff_t index,
 		}
 	}
 out:
-	spin_unlock(&node->tree_lock);
 	return err;
 }
 
@@ -792,7 +790,7 @@ tcache_attach_page(struct tcache_node *node, pgoff_t index, struct page *page)
 
 	tcache_init_page(page, node, index);
 
-	local_irq_save(flags);
+	spin_lock_irqsave(&node->tree_lock, flags);
 	err = tcache_page_tree_replace(node, index, page, &old_page);
 	if (err)
 		goto out;
@@ -804,7 +802,7 @@ tcache_attach_page(struct tcache_node *node, pgoff_t index, struct page *page)
 	tcache_hold_page(page);
 	tcache_lru_add(node->pool, page);
 out:
-	local_irq_restore(flags);
+	spin_unlock_irqrestore(&node->tree_lock, flags);
 	return err;
 }