You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Nick Piggin 945754a175 mm: fix race in COW logic ... There is a race in the COW logic. It contains a shortcut to avoid the COW and reuse the page if we have the sole reference on the page, however it is possible to have two racing do_wp_page()ers with one causing the other to mistakenly believe it is safe to take the shortcut when it is not. This could lead to data corruption. Process 1 and process2 each have a wp pte of the same anon page (ie. one forked the other). The page's mapcount is 2. Then they both attempt to write to it around the same time... proc1 proc2 thr1 proc2 thr2 CPU0 CPU1 CPU3 do_wp_page() do_wp_page() trylock_page() can_share_swap_page() load page mapcount (==2) reuse = 0 pte unlock copy page to new_page pte lock page_remove_rmap(page); trylock_page() can_share_swap_page() load page mapcount (==1) reuse = 1 ptep_set_access_flags (allow W) write private key into page read from page ptep_clear_flush() set_pte_at(pte of new_page) Fix this by moving the page_remove_rmap of the old page after the pte clear and flush. Potentially the entire branch could be moved down here, but in order to stay consistent, I won't (should probably move all the *_mm_counter stuff with one patch). Signed-off-by: Nick Piggin <npiggin@suse.de> Acked-by: Hugh Dickins <hugh@veritas.com> Cc: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>		17 years ago
..
Kconfig	…
Makefile	…
allocpercpu.c	…
backing-dev.c	mm: bdi: fix race in bdi_class device creation	17 years ago
bootmem.c	Add return value to reserve_bootmem_node()	17 years ago
bounce.c	…
dmapool.c	…
fadvise.c	…
filemap.c	…
filemap_xip.c	…
fremap.c	…
highmem.c	…
hugetlb.c	hugetlb: fix lockdep error	17 years ago
internal.h	…
maccess.c	…
madvise.c	…
memcontrol.c	…
memory.c	mm: fix race in COW logic	17 years ago
memory_hotplug.c	memory_hotplug: always initialize pageblock bitmap	17 years ago
mempolicy.c	…
mempool.c	…
migrate.c	Reinstate ZERO_PAGE optimization in 'get_user_pages()' and fix XIP	17 years ago
mincore.c	…
mlock.c	…
mmap.c	brk: make sys_brk() honor COMPAT_BRK when computing lower bound	17 years ago
mmzone.c	…
mprotect.c	…
mremap.c	…
msync.c	…
nommu.c	nommu: Correct kobjsize() page validity checks.	17 years ago
oom_kill.c	…
page-writeback.c	…
page_alloc.c	mm: Minor clean-up of page flags in mm/page_alloc.c	17 years ago
page_io.c	…
page_isolation.c	…
pagewalk.c	pagemap: pass mm into pagewalkers	17 years ago
pdflush.c	…
prio_tree.c	…
quicklist.c	…
readahead.c	…
rmap.c	…
shmem.c	…
shmem_acl.c	…
slab.c	Slab: Fix memory leak in fallback_alloc()	17 years ago
slob.c	slob: Fix to return wrong pointer	17 years ago
slub.c	slub: ksize() abuse checks	17 years ago
sparse-vmemmap.c	…
sparse.c	…
swap.c	mm: fix atomic_t overflow in vm	17 years ago
swap_state.c	…
swapfile.c	…
thrash.c	…
tiny-shmem.c	…
truncate.c	…
util.c	…
vmalloc.c	…
vmscan.c	mm: fix incorrect variable type in do_try_to_free_pages()	17 years ago
vmstat.c	…