First off, thank you very much for reworking this for me. I haven't got a chance to get a test machine for this. > shared_policy_replace() use of sp_alloc() is unsafe. 1) sp_node cannot > be dereferenced if sp->lock is not held and 2) another thread can modify > sp_node between spin_unlock for allocating a new sp node and next spin_lock. > The bug was introduced before 2.6.12-rc2. > > Kosaki's original patch for this problem was to allocate an sp node and policy > within shared_policy_replace and initialise it when the lock is reacquired. I > was not keen on this approach because it partially duplicates sp_alloc(). As > the paths were sp->lock is taken are not that performance critical this > patch converts sp->lock to sp->mutex so it can sleep when calling sp_alloc(). Looks make sense. Acked-by: KOSAKI Motohiro <kosaki.motohiro@xxxxxxxxxxxxxx> -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@xxxxxxxxx. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: <a href=mailto:"dont@xxxxxxxxx";> email@xxxxxxxxx </a>