[PATCH] blk_run_page() race fix

blk_run_page() is incorrectly using page->mapping, which makes it racy against
removal from swapcache.

Make block_sync_page() use page_mapping(), and remove bkl_run_page(), which
only had one caller.

diff --git a/fs/buffer.c b/fs/buffer.c
index 8c6abdcb22cf6b4f196bca1da50bf6c93b5f1a2c..9f76190d4654503532c770f4aaec13dbb3083fab 100644 (file)
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -2960,7 +2960,12 @@ EXPORT_SYMBOL(try_to_free_buffers);
 
 int block_sync_page(struct page *page)
 {
-       blk_run_page(page);
+       struct address_space *mapping;
+
+       smp_mb();
+       mapping = page_mapping(page);
+       if (mapping)
+               blk_run_backing_dev(mapping->backing_dev_info, page);
        return 0;
 }
 

diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index 03018e2f974a3f324b475e126c80376a3aa9cfc6..020a72f207426488f45991110b32a402c0904881 100644 (file)
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -545,16 +545,6 @@ static inline void blk_run_address_space(struct address_space *mapping)
                blk_run_backing_dev(mapping->backing_dev_info, NULL);
 }
 
-static inline void blk_run_page(struct page *page)
-{
-       struct address_space *mapping;
-
-       smp_mb();
-       mapping = page->mapping;
-       if (mapping)
-               blk_run_backing_dev(mapping->backing_dev_info, page);
-}
-
 /*
  * end_request() and friends. Must be called with the request queue spinlock
  * acquired. All functions called within end_request() _must_be_ atomic.