mm: fix clear_page_dirty_for_io vs fault race

Fix msync data loss and (less importantly) dirty page accounting
inaccuracies due to the race remaining in clear_page_dirty_for_io().

The deleted comment explains what the race was, and the added comments
explain how it is fixed.

Signed-off-by: Nick Piggin <npiggin@suse.de>
Acked-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Miklos Szeredi <miklos@szeredi.hu>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

1 files changed, 9 insertions, 0 deletions

diff --git a/mm/memory.c b/mm/memory.c
index 61d51da7e17c..50dd3d1f4d18 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -1765,6 +1765,15 @@ gotten:
 unlock:
         pte_unmap_unlock(page_table, ptl);
         if (dirty_page) {
+                /*
+                 * Yes, Virginia, this is actually required to prevent a race
+                 * with clear_page_dirty_for_io() from clearing the page dirty
+                 * bit after it clear all dirty ptes, but before a racing
+                 * do_wp_page installs a dirty pte.
+                 *
+                 * do_no_page is protected similarly.
+                 */
+                wait_on_page_locked(dirty_page);
                 set_page_dirty_balance(dirty_page);
                 put_page(dirty_page);
         }