Commit 6527c2bd authored by Vladimir V. Saveliev's avatar Vladimir V. Saveliev Committed by Linus Torvalds
Browse files

[PATCH] generic_file_buffered_write(): deadlock on vectored write

generic_file_buffered_write() prefaults in user pages in order to avoid
deadlock on copying from the same page as write goes to.

However, it looks like there is a problem when write is vectored:
fault_in_pages_readable brings in current segment or its part (maxlen).
OTOH, filemap_copy_from_user_iovec is called to copy number of bytes
(bytes) which may exceed current segment, so filemap_copy_from_user_iovec
switches to the next segment which is not brought in yet.  Pagefault is
generated.  That causes the deadlock if pagefault is for the same page
write goes to: page being written is locked and not uptodate, pagefault
will deadlock trying to lock locked page.

[ somewhat rewritten]
Cc: Neil Brown <>
Cc: Martin Schwidefsky <>
Cc: <>
Signed-off-by: default avatarAndrew Morton <>
Signed-off-by: default avatarLinus Torvalds <>
parent 1c0f16e5
......@@ -2095,14 +2095,21 @@ generic_file_buffered_write(struct kiocb *iocb, const struct iovec *iov,
do {
unsigned long index;
unsigned long offset;
unsigned long maxlen;
size_t copied;
offset = (pos & (PAGE_CACHE_SIZE -1)); /* Within page */
index = pos >> PAGE_CACHE_SHIFT;
bytes = PAGE_CACHE_SIZE - offset;
if (bytes > count)
bytes = count;
/* Limit the size of the copy to the caller's write size */
bytes = min(bytes, count);
* Limit the size of the copy to that of the current segment,
* because fault_in_pages_readable() doesn't know how to walk
* segments.
bytes = min(bytes, cur_iov->iov_len - iov_base);
* Bring in the user page that we will copy from _first_.
......@@ -2110,10 +2117,7 @@ generic_file_buffered_write(struct kiocb *iocb, const struct iovec *iov,
* same page as we're writing to, without it being marked
* up-to-date.
maxlen = cur_iov->iov_len - iov_base;
if (maxlen > bytes)
maxlen = bytes;
fault_in_pages_readable(buf, maxlen);
fault_in_pages_readable(buf, bytes);
page = __grab_cache_page(mapping,index,&cached_page,&lru_pvec);
if (!page) {
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment