Skip to contentSkip to conversation

mm->rss modified without the page_table_lock (revisited)

PATCH Rasmus Andersen 1 participant 1 message Nov 23, 2000

Subsystems (6)
Memory management MM core MGLRU Memory mapping +2 more subsystems
lore
Share & tools
lore

Rasmus Andersen

author
#0 lore raw

Hi.

Some time ago there was a thread about subject and a patch was posted (by davej?). It was rejected because of the vmlist_modify_{un}lock mess (AFAIR) and nothing has been done since. The first patch below moves mm->rss inside the page_table_lock in mm/.

I noticed that mm->rss is also modified in fs/{exec.c,binfmt_aout.c, binfmt_elf.c} without the lock being held. Am I missing something or are these buggy too? I have no idea of what assumptions can be made in these code paths so I have not tried to produce patches for them.

Patch against 240-test11. Please comment.

mm/memory.c +7 -1
diff -uar linux-240-t11/mm/memory.c linux/mm/memory.c
@@ -369,7 +369,6 @@
 		address = (address + PGDIR_SIZE) & PGDIR_MASK;
 		dir++;
 	} while (address && (address < end));
-	spin_unlock(&mm->page_table_lock);
 	/*
 	 * Update rss for the mm_struct (not necessarily current->mm)
 	 * Notice that rss is an unsigned long.

@@ -378,6 +377,7 @@
 		mm->rss -= freed;
 	else
 		mm->rss = 0;
+	spin_unlock(&mm->page_table_lock);
 }
 
 

@@ -1074,7 +1074,9 @@
 		flush_icache_page(vma, page);
 	}
 
+	spin_lock(&mm->page_table_lock);
 	mm->rss++;
+	spin_unlock(&mm->page_table_lock);
 
 	pte = mk_pte(page, vma->vm_page_prot);
 

@@ -1113,7 +1115,9 @@
 			return -1;
 		clear_user_highpage(page, addr);
 		entry = pte_mkwrite(pte_mkdirty(mk_pte(page, vma->vm_page_prot)));
+		spin_lock(&mm->page_table_lock);
 		mm->rss++;
+		spin_unlock(&mm->page_table_lock);
 		flush_page_to_ram(page);
 	}
 	set_pte(page_table, entry);

@@ -1152,7 +1156,9 @@
 		return 0;
 	if (new_page == NOPAGE_OOM)
 		return -1;
+	spin_lock(&mm->page_table_lock);
 	++mm->rss;
+	spin_unlock(&mm->page_table_lock);
 	/*
 	 * This silly early PAGE_DIRTY setting removes a race
 	 * due to the bad i386 page protection. But it's valid
mm/mmap.c +1 -1
diff -uar linux-240-t11/mm/mmap.c linux/mm/mmap.c
@@ -889,8 +889,8 @@
 	spin_lock(&mm->page_table_lock);
 	mpnt = mm->mmap;
 	mm->mmap = mm->mmap_avl = mm->mmap_cache = NULL;
-	spin_unlock(&mm->page_table_lock);
 	mm->rss = 0;
+	spin_unlock(&mm->page_table_lock);
 	mm->total_vm = 0;
 	mm->locked_vm = 0;
 	while (mpnt) {
mm/swapfile.c +2 -0
diff -uar linux-240-t11/mm/swapfile.c linux/mm/swapfile.c
@@ -231,7 +231,9 @@
 	set_pte(dir, pte_mkdirty(mk_pte(page, vma->vm_page_prot)));
 	swap_free(entry);
 	get_page(page);
+	spin_lock(&vma->vm_mm->page_table_lock);
 	++vma->vm_mm->rss;
+	spin_unlock(&vma->vm_mm->page_table_lock);
 }
 
 static inline void unuse_pmd(struct vm_area_struct * vma, pmd_t *dir,
mm/vmscan.c +2 -0
diff -uar linux-240-t11/mm/vmscan.c linux/mm/vmscan.c
@@ -95,7 +95,9 @@
 		set_pte(page_table, swp_entry_to_pte(entry));
 drop_pte:
 		UnlockPage(page);
+		spin_lock(&mm->page_table_lock);
 		mm->rss--;
+		spin_unlock(&mm->page_table_lock);
 		flush_tlb_page(vma, address);
 		deactivate_page(page);
 		page_cache_release(page);
Signature · 9 lines
Regards,
        Rasmus([email protected])

Gates' Law: Every 18 months, the speed of software halves
  -- Anonymous
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
Please read the FAQ at http://www.tux.org/lkml/