This has been there for nearly two years.  See bugzilla #1403

vmscan.c does, in two places:

	spin_lock(zone->lru_lock)
	page = lru_to_page(&zone->inactive_list);
	if (page_count(page) == 0) {
		/* erk, it's being freed by __page_cache_release() or
		 * release_pages()
		 */
		put_it_back_on_the_lru();

	} else {

	--> window 1 <--

		page_cache_get(page);
		put_in_on_private_list();
	}
	spin_unlock(zone->lru_lock)

	use_the_private_list();

	page_cache_release(page);



whereas __page_cache_release() and release_pages() do:

	if (put_page_testzero(page)) {

	--> window 2 <--

		spin_lock(lru->lock);
		if (page_count(page) == 0) {
			remove_it_from_the_lru();
			really_free_the_page()
		}
		spin_unlock(zone->lru_lock)
	}


The race occurs if the vmscan.c path sees page_count()==1 and then the
page_cache_release() path happens in that few-instruction "window 1" before
vmscan's page_cache_get().

The page_cache_release() path does put_page_testzero(), which returns true.
Then this CPU takes an interrupt...

The vmscan.c path then does page_cache_get(), taking the refcount to one.
Then it uses the page and does page_cache_release(), taking the refcount to
zero and the page is really freed.

Now, the CPU running page_cache_release() returns from the interrupt, takes
the LRU lock, sees the page still has a refcount of zero and frees it again.
Boom.


The patch fixes this by closing "window 1".  We provide a
"get_page_testone()" which grabs a ref on the page and returns true if the
refcount was previously zero.  If that happens the vmscan.c code simply drops
the page's refcount again and leaves the page on the LRU.

All this happens under the zone->lru_lock, which is also taken by
__page_cache_release() and release_pages(), so the vmscan code knows that the
page has not been returned to the page allocator yet.


In terms of implementation, the page counts are now offset by one: a free page
has page->_count of -1.  This is so that we can use atomic_add_negative() and
atomic_inc_and_test() to provide put_page_testzero() and get_page_testone().

The macros hide all of this so the public interpretation of page_count() and
set_page_count() remains unaltered.

The compiler can usually constant-fold the offsetting of page->count.  This
patch increases an x86 SMP kernel's text by 32 bytes.

The patch renames page->count to page->_count to break callers who aren't
using the macros.

This patch requires that the architecture implement atomic_add_negative().  It
is currently present on

	arm
	arm26
	i386
	ia64
	mips
	ppc
	s390
	v850
	x86_64

ppc implements this as

#define atomic_add_negative(a, v)	(atomic_add_return((a), (v)) < 0)

and atomic_add_return() is implemented on

	alpha
	cris
	h8300
	ia64
	m68knommu
	mips
	parisc
	ppc
	ppc
	ppc64
	s390
	sh
	sparc
	v850

so we're looking pretty good.

From: David Mosberger <davidm@napali.hpl.hp.com>

From: Ivan Kokshaysky <ink@jurassic.park.msu.ru>

It seems atomic_inc_and_test() is missing on alpha.

It's easy to do when the arch provides atomic_inc_return().

Lots of architectures have atomic_add_return() and no atomic_add_negative().

We can implement the latter in terms of the former.

I'm about to change the meaning (and name) of page->count.  Go through and fix
up all those places which are open-coding references to it.

into redhat.com:/spare/repo/net-drivers-2.6

into ppc970.osdl.org:/home/torvalds/v2.6/linux

into ppc970.osdl.org:/home/torvalds/v2.6/linux

into ppc970.osdl.org:/home/torvalds/v2.6/linux

into kroah.com:/home/greg/linux/BK/driver-2.6

into kroah.com:/home/greg/linux/BK/i2c-2.6

Forgot to include this with my original patch a few weeks ago...

Jean Delvare <khali@linux-fr.org> writes:
> So I'd suggest that you simply use the standard exit sequence in the
> it87 driver (the second one in your current patch). A patch for the 2.4
> driver would be appreciated as well.

OK.  I've attached a new version of the patch against linux-2.6.6.
I'll send a patch against current lm_sensors CVS removing the extra
exit command in a separate mail.

Greg KH <greg@kroah.com> writes:
> On Wed, May 12, 2004 at 04:38:03PM +0200, Bj?rn Mork wrote:
>> +	if (!it87_find(&addr)) {
>> +		printk("it87.o: new ISA address: 0x%04x\n", addr);
>
> That printk is wrong (no KERN_ level, or dev_printk() style use).
> Please fix it in your next revision of this patch.

Errh, I just added it to document my sloppyness.  It was never meant
to be in the patch I sent you.  Sorry.  Removed in the attached patch.
The style of these drivers seem to be "just working, making no noise"
so I assume informational printk's are unwanted.

This patch adds DID support for ICH6 and 6300ESB to i2c-i801.c(SMBus).
In order to add this support I needed to patch pci_ids.h with the SMBus
DID's.  To keep things orginized I renumbered the ICH6 and ESB entries
in pci_ids.h.  I then patched the piix IDE and i810 audio drivers to
reflect the updated #define's.  I also removed an error from irq.c;
there was a reference to a 6300ESB DID that does not exist.

into ppc970.osdl.org:/home/torvalds/v2.6/linux

I needed this to get an APM + UHCI config to behave on resume.
Applies against your BK of last night ... OHCI and EHCI do
some of this manually, they could be simplified later.

o The following patch cleans up sysfs_rename_dir(). It now checks the
  return code of kobject_set_name() and propagates the error code to its
  callers. Because of this there are changes in the following two APIs. Both
  return int instead of void.

int sysfs_rename_dir(struct kobject * kobj, const char *new_name)
int kobject_rename(struct kobject * kobj, char *new_name)

[note, I changed this a bit to be nicer on the system log, greg k-h]

Prakash K. Cheemplavam wrote:
> David Brownell wrote:
>
>>> There appear lines like

> >>> usb usb2: string descriptor 0 read error: -108

>>> bug or feature? They weren't there with 2.6.6-mm1. I have no usb2.0
>>> stuff to actually test. My usb1 stuff seems to work though.
>>
>> Bug; minor, since the only real symptom seems to be messages like
>> that.  Ignore them for now, I'll make a patch soonish.
>
> Ok, good. Thanks for the explanation of what is going on, though I don't
> can make too much out of it. ;-)

The short version is:  it's missing this patch.

It also could hide real bugs, and that's not good.  And the name
implies that a reference is grabbed, and that's not true at all.

If this is hiding real problems, we need to find them.

Pretty useless stuff.  If this was hiding anything real, we need to find out.

Following patch merges the support for Keyspan UPR-112 USB serial adapter
from 2.4 to 2.6.

Also fix up some of the other printk() calls to be dev_* calls.

"Matt H." <lkml@lpbproductions.com> wrote:
>
> Just attempted to compile 2.6.6-mm2 and got this error
>
>    CC [M]  drivers/usb/core/driverfs.o
>    CC [M]  drivers/usb/core/hcd-pci.o
>    LD [M]  drivers/usb/core/usbcore.o
>    LD      drivers/usb/host/built-in.o
>    CC [M]  drivers/usb/host/ehci-hcd.o
>    CC [M]  drivers/usb/host/ohci-hcd.o
>  In file included from drivers/usb/host/ohci-hcd.c:129:
>  drivers/usb/host/ohci-hub.c: In function `ohci_rh_resume':
>  drivers/usb/host/ohci-hub.c:313: error: `hcd' undeclared (first use in this
>  function)

hm, not sure what's happened there...

On Thu, 13 May 2004, Duncan Sands wrote:

> No, but the pointer for another (previous) interface may just have been
> set to NULL, causing an Oops when usb_ifnum_to_if loops over all
> interfaces.

Of course!  I trust you won't mind me changing your suggested fix
slightly.  This should do an equally good job of repairing things, and it
will prevent other possible invalid references as well.

> I went ahead and created a patch to change all the places where devio.c
> uses an interface index.  Now it always uses just the interface number.
> Does this look all right to you?  I don't have a convenient way to test
> it.

Hi Alan, thanks for doing this.  It looks and works OK.  I added some name
changes: all struct usb_interface pointers are now called intf; and, when
reasonable, variables holding interface numbers are now all called ifnum.
This drowns your original changes in a sea of churning names, I hope you
don't mind.

This patch should help correct the "missing diagnostics with
CONFIG_USB_DEBUG during CDC Ethernet probe()" issue.  Some
folk are having problems with firmware that doesn't respond
properly to descriptor fetches -- which is unnecessarily
confusing because the diagnostics aren't being printed.

into kroah.com:/home/greg/linux/BK/usb-2.6

The following patch fixes the race involved between unregistering a kobject
and simultaneously opeing a corresponding attribute file in sysfs.

Ideally sysfs should take a ref.  to the kobject as long as it has dentries
referring to the kobjects, but because of current limitations in
module/kobject ref counting, sysfs's pinning of kobject leads to
hang/delays in rmmod of certain modules.  The patch checks for unhashed
dentries in check_perm() while opening a sysfs file.  If the dentry is
still hashed then it goes ahead and takes the ref to kobject.  This done
under the per dentry lock.  It does this in the inline routine
sysfs_get_kobject(dentry).