On Tue, Jul 25, 2017 at 06:04:00PM +0200, Michal Hocko wrote: > - down_write(&mm->mmap_sem); > + if (tsk_is_oom_victim(current)) > + down_write(&mm->mmap_sem); > free_pgtables(&tlb, vma, FIRST_USER_ADDRESS, USER_PGTABLES_CEILING); > tlb_finish_mmu(&tlb, 0, -1); > > @@ -3012,7 +3014,8 @@ void exit_mmap(struct mm_struct *mm) > } > mm->mmap = NULL; > vm_unacct_memory(nr_accounted); > - up_write(&mm->mmap_sem); > + if (tsk_is_oom_victim(current)) > + up_write(&mm->mmap_sem); How is this possibly safe? mark_oom_victim can run while exit_mmap is running. Even if you cache the first read in the local stack, failure to notice you marked it, could lead to use after free. Or at least there's no comment on which lock should prevent the use after free with the above. -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@xxxxxxxxx. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: <a href=mailto:"dont@xxxxxxxxx";> email@xxxxxxxxx </a>
