2.4.18(19) swapcache oops

j-nomura@ce.jp.nec.com
Thu, 15 Aug 2002 21:39:29 +0900 (JST)


Hello,

I'm using 2.4.18 kernel and suspect there are swapcache race.
I looked into 2.4.19 patch but could not find the fix to it.

The race condition is described below.
Do you have any idea?

In the situation such as:
- two processes (process A and B) sharing memory space
- one of the pages in the space has been swapped out and
not remained in swapcache
- process A runs on cpu0, process B runs on cpu1

when process A reads the address corresponding to the page,
page fault occurs and the cpu0 reads swapped-out page into memory,
calls add_to_page_cache_unique() to add it to swapcache and then
calls lru_cache_add() to add it to lru list.

If process B reads the same address at that time, cpu1 calls
do_swap_page() and lookup_swap_cache() may succeed before cpu0
calls lru_cache_add() and cpu1 will set the page active by
following mark_page_accessed().

lru_cache_add() checks if the page is active and if it is active,
it calls BUG().

process A process B
cpu0 cpu1
-----------------------------------------------------------
do_swap_page()
spinunlock(mm->page_table_lock)
spinlock(mm->page_table_lock)
lookup_swap_cache()
read_swap_cache_async()
alloc_page()
add_to_swap_cache_unique()
__add_to_page_cache()
do_swap_page()
lookup_swap_cache()
mark_page_accessed()
lru_cache_add()

Best regards.

--
NOMURA, Jun'ichi <j-nomura@ce.jp.nec.com, nomura@hpc.bs1.fc.nec.co.jp>
HPC Operating System Group, 1st Computers Software Division,
Computers Software Operations Unit, NEC Solutions.
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/