[PATCH] Fix buddy list race that could lead to page lru list corruptions

Rohit found an obscure bug causing buddy list corruption.

page_is_buddy is using a non-atomic test (PagePrivate && page_count == 0)
to determine whether or not a free page's buddy is itself free and in the
buddy lists.

Each of the conjuncts may be true at different times due to unrelated
conditions, so the non-atomic page_is_buddy test may find each conjunct to
be true even if they were not both true at the same time (ie. the page was
not on the buddy lists).

Signed-off-by: Martin Bligh <mbligh@google.com>
Signed-off-by: Rohit Seth <rohitseth@google.com>
Signed-off-by: Nick Piggin <npiggin@suse.de>
Signed-off-by: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

2 files changed, 9 insertions, 4 deletions

diff --git a/include/linux/mm.h b/include/linux/mm.h
index 6aa016f1d3ae..1154684209a4 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -229,10 +229,9 @@ struct page {
                 unsigned long private;          /* Mapping-private opaque data:
                                                  * usually used for buffer_heads
                                                  * if PagePrivate set; used for
-                                                 * swp_entry_t if PageSwapCache.
-                                                 * When page is free, this
+                                                 * swp_entry_t if PageSwapCache;
                                                  * indicates order in the buddy
-                                                 * system.
+                                                 * system if PG_buddy is set.
                                                  */
                 struct address_space *mapping;  /* If low bit clear, points to
                                                  * inode address_space, or NULL.
diff --git a/include/linux/page-flags.h b/include/linux/page-flags.h
index 9ea629c02a4b..547aac7696cd 100644
--- a/include/linux/page-flags.h
+++ b/include/linux/page-flags.h
@@ -74,7 +74,9 @@
 #define PG_mappedtodisk         16      /* Has blocks allocated on-disk */
 #define PG_reclaim              17      /* To be reclaimed asap */
 #define PG_nosave_free          18      /* Free, should not be written */
-#define PG_uncached             19      /* Page has been mapped as uncached */
+#define PG_buddy                19      /* Page is free, on buddy lists */
+
+#define PG_uncached             20      /* Page has been mapped as uncached */
 
 /*
  * Global page accounting.  One instance per CPU.  Only unsigned longs are
@@ -317,6 +319,10 @@ extern void __mod_page_state_offset(unsigned long offset, unsigned long delta);
 #define SetPageNosaveFree(page) set_bit(PG_nosave_free, &(page)->flags)
 #define ClearPageNosaveFree(page)               clear_bit(PG_nosave_free, &(page)->flags)
 
+#define PageBuddy(page)         test_bit(PG_buddy, &(page)->flags)
+#define __SetPageBuddy(page)    __set_bit(PG_buddy, &(page)->flags)
+#define __ClearPageBuddy(page)  __clear_bit(PG_buddy, &(page)->flags)
+
 #define PageMappedToDisk(page)  test_bit(PG_mappedtodisk, &(page)->flags)
 #define SetPageMappedToDisk(page) set_bit(PG_mappedtodisk, &(page)->flags)
 #define ClearPageMappedToDisk(page) clear_bit(PG_mappedtodisk, &(page)->flags)