https://github.com/torvalds/linux
Revision 914ee295af418e936ec20a08c1663eaabe4cd07a authored by Xin Zhong on 09 December 2010, 09:30:14 UTC, committed by Chris Mason on 10 December 2010, 21:29:10 UTC
This problem is found in meego testing: http://bugs.meego.com/show_bug.cgi?id=6672 A file in btrfs is mmaped and the mmaped buffer is passed to pwrite to write to the same page of the same file. In btrfs_file_aio_write(), the pages is locked by prepare_pages(). So when btrfs_copy_from_user() is called, page fault happens and the same page needs to be locked again in filemap_fault(). The fix is to move iov_iter_fault_in_readable() before prepage_pages() to make page fault happen before pages are locked. And also disable page fault in critical region in btrfs_copy_from_user(). Reviewed-by: Yan, Zheng<zheng.z.yan@intel.com> Signed-off-by: Zhong, Xin <xin.zhong@intel.com> Signed-off-by: Chris Mason <chris.mason@oracle.com>
1 parent f106e82
Tip revision: 914ee295af418e936ec20a08c1663eaabe4cd07a authored by Xin Zhong on 09 December 2010, 09:30:14 UTC
Btrfs: pwrite blocked when writing from the mmaped buffer of the same page
Btrfs: pwrite blocked when writing from the mmaped buffer of the same page
Tip revision: 914ee29
| File | Mode | Size |
|---|---|---|
| Kconfig | -rw-r--r-- | 1000 bytes |
| Makefile | -rw-r--r-- | 455 bytes |
| acl.c | -rw-r--r-- | 6.5 KB |
| async-thread.c | -rw-r--r-- | 17.9 KB |
| async-thread.h | -rw-r--r-- | 3.8 KB |
| btrfs_inode.h | -rw-r--r-- | 4.7 KB |
| compat.h | -rw-r--r-- | 162 bytes |
| compression.c | -rw-r--r-- | 17.3 KB |
| compression.h | -rw-r--r-- | 1.7 KB |
| ctree.c | -rw-r--r-- | 115.0 KB |
| ctree.h | -rw-r--r-- | 82.3 KB |
| delayed-ref.c | -rw-r--r-- | 21.7 KB |
| delayed-ref.h | -rw-r--r-- | 6.3 KB |
| dir-item.c | -rw-r--r-- | 12.1 KB |
| disk-io.c | -rw-r--r-- | 70.2 KB |
| disk-io.h | -rw-r--r-- | 4.6 KB |
| export.c | -rw-r--r-- | 7.8 KB |
| export.h | -rw-r--r-- | 301 bytes |
| extent-tree.c | -rw-r--r-- | 223.9 KB |
| extent_io.c | -rw-r--r-- | 94.7 KB |
| extent_io.h | -rw-r--r-- | 11.9 KB |
| extent_map.c | -rw-r--r-- | 10.0 KB |
| extent_map.h | -rw-r--r-- | 1.7 KB |
| file-item.c | -rw-r--r-- | 22.5 KB |
| file.c | -rw-r--r-- | 32.9 KB |
| free-space-cache.c | -rw-r--r-- | 53.0 KB |
| free-space-cache.h | -rw-r--r-- | 2.8 KB |
| hash.h | -rw-r--r-- | 878 bytes |
| inode-item.c | -rw-r--r-- | 6.3 KB |
| inode-map.c | -rw-r--r-- | 2.1 KB |
| inode.c | -rw-r--r-- | 194.6 KB |
| ioctl.c | -rw-r--r-- | 55.3 KB |
| ioctl.h | -rw-r--r-- | 5.3 KB |
| locking.c | -rw-r--r-- | 6.1 KB |
| locking.h | -rw-r--r-- | 1.1 KB |
| ordered-data.c | -rw-r--r-- | 25.2 KB |
| ordered-data.h | -rw-r--r-- | 5.4 KB |
| orphan.c | -rw-r--r-- | 2.1 KB |
| print-tree.c | -rw-r--r-- | 10.8 KB |
| print-tree.h | -rw-r--r-- | 906 bytes |
| ref-cache.c | -rw-r--r-- | 5.5 KB |
| ref-cache.h | -rw-r--r-- | 2.2 KB |
| relocation.c | -rw-r--r-- | 102.1 KB |
| root-tree.c | -rw-r--r-- | 11.2 KB |
| struct-funcs.c | -rw-r--r-- | 4.9 KB |
| super.c | -rw-r--r-- | 23.6 KB |
| sysfs.c | -rw-r--r-- | 6.8 KB |
| transaction.c | -rw-r--r-- | 36.2 KB |
| transaction.h | -rw-r--r-- | 4.4 KB |
| tree-defrag.c | -rw-r--r-- | 3.5 KB |
| tree-log.c | -rw-r--r-- | 84.7 KB |
| tree-log.h | -rw-r--r-- | 2.2 KB |
| version.h | -rw-r--r-- | 95 bytes |
| version.sh | -rw-r--r-- | 1000 bytes |
| volumes.c | -rw-r--r-- | 85.5 KB |
| volumes.h | -rw-r--r-- | 5.4 KB |
| xattr.c | -rw-r--r-- | 9.5 KB |
| xattr.h | -rw-r--r-- | 1.6 KB |
| zlib.c | -rw-r--r-- | 16.2 KB |
Computing file changes ...
