On Tue, 2011-06-07 at 18:28 +0530, Srikar Dronamraju wrote:
> +static int __replace_page(struct vm_area_struct *vma, struct page *page,
> + struct page *kpage)
> +{
> + struct mm_struct *mm = vma->vm_mm;
> + pgd_t *pgd;
> + pud_t *pud;
> + pmd_t *pmd;
> + pte_t *ptep;
> + spinlock_t *ptl;
> + unsigned long addr;
> + int err = -EFAULT;
> +
> + addr = page_address_in_vma(page, vma);
> + if (addr == -EFAULT)
> + goto out;
> +
> + pgd = pgd_offset(mm, addr);
> + if (!pgd_present(*pgd))
> + goto out;
> +
> + pud = pud_offset(pgd, addr);
> + if (!pud_present(*pud))
> + goto out;
> +
> + pmd = pmd_offset(pud, addr);
> + if (pmd_trans_huge(*pmd) || (!pmd_present(*pmd)))
> + goto out;
> +
> + ptep = pte_offset_map_lock(mm, pmd, addr, &ptl);
> + if (!ptep)
> + goto out;
Shouldn't we verify that the obtained pte does indeed refer to our @page
here?
> + get_page(kpage);
> + page_add_new_anon_rmap(kpage, vma, addr);
> +
> + flush_cache_page(vma, addr, pte_pfn(*ptep));
> + ptep_clear_flush(vma, addr, ptep);
> + set_pte_at_notify(mm, addr, ptep, mk_pte(kpage, vma->vm_page_prot));
> +
> + page_remove_rmap(page);
> + if (!page_mapped(page))
> + try_to_free_swap(page);
> + put_page(page);
> + pte_unmap_unlock(ptep, ptl);
> + err = 0;
> +
> +out:
> + return err;
> +}
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@xxxxxxxxxx For more info on Linux MM,
see: http://www.linux-mm.org/ .
Fight unfair telecom internet charges in Canada: sign http://stopthemeter.ca/
Don't email: <a href