mm: fix page_lock_anon_vma leaving mutex locked (eee0f252) · Commits · e / devices / android_kernel_oneplus_sm8150

On one machine I've been getting hangs, a page fault's anon_vma_prepare() waiting in anon_vma_lock(), other processes waiting for that page's lock. This is a replay of last year's "mm: fix hang on anon_vma->root->lock". The new page_lock_anon_vma() places too much faith in its refcount: when it has acquired the mutex_trylock(), it's possible that a racing task in anon_vma_alloc() has just reallocated the struct anon_vma, set refcount to 1, and is about to reset its anon_vma->root. Fix this by saving anon_vma->root, and relying on the usual page_mapped() check instead of a refcount check: if page is still mapped, the anon_vma is still ours; if page is not still mapped, we're no longer interested. Signed-off-by:

Hugh Dickins <hughd@google.com> Signed-off-by:

Linus Torvalds <torvalds@linux-foundation.org>

mm/rmap.c

+8 −5

Original line number	Diff line number	Diff line
		@@ -405,6 +405,7 @@ struct anon_vma page_get_anon_vma(struct page page)
		struct anon_vma page_lock_anon_vma(struct page page)
		{
		struct anon_vma *anon_vma = NULL;
		struct anon_vma *root_anon_vma;
		unsigned long anon_mapping;

		rcu_read_lock();
		@@ -415,13 +416,15 @@ struct anon_vma page_lock_anon_vma(struct page page)
		goto out;

		anon_vma = (struct anon_vma *) (anon_mapping - PAGE_MAPPING_ANON);
		if (mutex_trylock(&anon_vma->root->mutex)) {
		root_anon_vma = ACCESS_ONCE(anon_vma->root);
		if (mutex_trylock(&root_anon_vma->mutex)) {
		/*
		* If we observe a !0 refcount, then holding the lock ensures
		* the anon_vma will not go away, see __put_anon_vma().
		* If the page is still mapped, then this anon_vma is still
		* its anon_vma, and holding the mutex ensures that it will
		* not go away, see __put_anon_vma().
		*/
		if (!atomic_read(&anon_vma->refcount)) {
		anon_vma_unlock(anon_vma);
		if (!page_mapped(page)) {
		mutex_unlock(&root_anon_vma->mutex);
		anon_vma = NULL;
		}
		goto out;