Commit 9a24d04a authored by Ingo Molnar's avatar Ingo Molnar Committed by Thomas Gleixner

x86: fix global_flush_tlb() bug

While we were reviewing pageattr_32/64.c for unification,
Thomas Gleixner noticed the following serious SMP bug in

	list_replace_init(&deferred_pages, &l);

this is SMP-unsafe because list_replace_init() done on two CPUs in
parallel can corrupt the list.

This bug has been introduced about a year ago in the 64-bit tree:

       commit ea7322de
       Author: Andi Kleen <>
       Date:   Thu Dec 7 02:14:05 2006 +0100

       [PATCH] x86-64: Speed and clean up cache flushing in change_page_attr

        -       dpage = xchg(&deferred_pages, NULL);
        +       list_replace_init(&deferred_pages, &l);

the xchg() based version was SMP-safe, but list_replace_init() is not.
So this "cleanup" introduced a nasty bug.

why this bug never become prominent is a mystery - it can probably be
explained with the (still) relative obscurity of the x86_64 architecture.

the safe fix for now is to write-lock init_mm.mmap_sem.
Signed-off-by: default avatarIngo Molnar <>
Signed-off-by: default avatarThomas Gleixner <>
parent 4fa4d23f
......@@ -230,9 +230,14 @@ void global_flush_tlb(void)
struct page *pg, *next;
struct list_head l;
* Write-protect the semaphore, to exclude two contexts
* doing a list_replace_init() call in parallel and to
* exclude new additions to the deferred_pages list:
list_replace_init(&deferred_pages, &l);
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment