Re: highmem-2.4.7-A0 [Re: kmap() while holding spinlock]

[Hugh Dickins]

On Thu, 26 Jul 2001, Jeremy Linton wrote:
> > > [...] or to do the clearing (and copying) speculatively, after
> > > allocating the page but before locking the pagetable lock. This might
> > > lead to a bit more work in the pagefault-race case, but we dont care
> > > about that window. It will on the other hand reduce pagetable_lock
> > > contention (because the clearing/copying is done outside the lock), so
> > > perhaps this solution is better.
> >
> > the attached highmem-2.4.7-A0 patch implements this method in both
> > affected functions. Comments?
>     It seems to me that the problem is more fundamental than that. Excuse my
> ignorance, but what keeps the 'old_page' (and associated pte, checked two
> lines down) from disappearing somewhere between the lock drop, alloc page
> and the copy from the old page? Normally if this happens it appears the new
> page gets dropped and the fault occurs again, and is resolved in a
> potentially different way.

I was about to answer this by pointing out that, although the pte may
change and the old_page be reused for some other purpose while we drop
the lock, the old_page won't actually "disappear".  It will remain
physically present, just containing irrelevant data: there won't be
any danger from copying the wrong data, we just notice further down
that the pte changed and discard this copy and fault again (or not).

But in writing, I realize (perhaps it's your very point, understated)
that it's conceivable (though *very* unlikely) that the old_page is
reused for some other purpose while we do the copy, then freed from
that use and reused for its original purpose by the time we regain the
lock: so that the pte_same() test succeeds yet the copied data is wrong.

Either do_wp_page() needs page_cache_get(old_page) before dropping
page_table_lock, page_cache_release(old_page) after reacquiring it;
or the kmap()s done while the lock is dropped, but copy_user_page()
and kunmap()s left until the lock has been reacquired.  Ingo?

Hugh