On Wed, Apr 02, 2014 at 10:03:24PM +0400, Konstantin Khlebnikov wrote:
> > +void filemap_map_pages(struct vm_area_struct *vma, struct vm_fault *vmf)
> > +{
> > + struct radix_tree_iter iter;
> > + void **slot;
> > + struct file *file = vma->vm_file;
> > + struct address_space *mapping = file->f_mapping;
> > + loff_t size;
> > + struct page *page;
> > + unsigned long address = (unsigned long) vmf->virtual_address;
> > + unsigned long addr;
> > + pte_t *pte;
> > +
> > + rcu_read_lock();
> > + radix_tree_for_each_slot(slot, &mapping->page_tree, &iter, vmf->pgoff) {
> > + if (iter.index > vmf->max_pgoff)
> > + break;
> > +repeat:
> > + page = radix_tree_deref_slot(slot);
>
> Here is obvious race with memory reclaimer/truncate. Pointer to page
> might become NULL.
Thanks for noticing that. It has been fixed in -mm already.
--
Kirill A. Shutemov
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@xxxxxxxxx. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@xxxxxxxxx";> email@xxxxxxxxx </a>