Commit cbc24afa authored by Paolo 'Blaisorblade' Giarrusso's avatar Paolo 'Blaisorblade' Giarrusso Committed by Linus Torvalds
Browse files

[PATCH] uml: remove bogus WARN_ON, triggerable harmlessly on a page fault race

The below warning was added in place of pte_mkyoung(); if (is_write)

In fact, if the PTE is not marked young/dirty, our dirty/accessed bit
emulation would cause the TLB permission not to be changed, and so we'd loop,
and given we don't support preemption yet, we'd busy-hang here.

However, I've seen this warning trigger without crashes during a loop of
concurrent kernel builds, at random times (i.e. like a race condition), and I
realized that two concurrent faults on the same page, one on read and one on
write, can trigger it. The read fault gets serviced and the PTE gets marked
writable but clean (it's possible on a shared-writable mapping), while the
generic code sees the PTE was already installed and returns without action. In
this case, we'll see another fault and service it normally.
Signed-off-by: default avatarPaolo 'Blaisorblade' Giarrusso <>
Acked-by: default avatarJeff Dike <>
Signed-off-by: default avatarAndrew Morton <>
Signed-off-by: default avatarLinus Torvalds <>
parent 2ab23c95
......@@ -95,7 +95,16 @@ survive:
pte = pte_offset_kernel(pmd, address);
} while(!pte_present(*pte));
err = 0;
/* The below warning was added in place of
* pte_mkyoung(); if (is_write) pte_mkdirty();
* If it's triggered, we'd see normally a hang here (a clean pte is
* marked read-only to emulate the dirty bit).
* However, the generic code can mark a PTE writable but clean on a
* concurrent read fault, triggering this harmlessly. So comment it out.
#if 0
WARN_ON(!pte_young(*pte) || (is_write && !pte_dirty(*pte)));
flush_tlb_page(vma, address);
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment