On Tue 28-04-15 09:01:59, Linus Torvalds wrote: [...] > Your code is also fundamentally buggy in that it tries to do unmap() > after it has dropped all locks, and things went wrong. So you may nto > be unmapping some other threads data. Hmm, no other thread has the address from the current mmap call except for MAP_FIXED (more on that below). Well I can imagine userspace doing nasty things like watching /proc/self/maps and using the address from there or using an address as an mmap hint and then using it before mmap returns by other threads. But would those be valid usecases? They sound crazy and buggy to me. Another nasty case would be MAP_FIXED from a different thread destroying the mmap I am trying to poppulate but that is not so interesting because nothing protects from that even now. Or this being MAP_FIXED|MAP_LOCKED which has already destroyed a part of somebody's else mapping and the cleanup would lead to an unexpected SIGSEGV for the other thread. Is this the case you are worried about? Or am I missing other cases? -- Michal Hocko SUSE Labs -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@xxxxxxxxx. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: <a href=mailto:"dont@xxxxxxxxx";> email@xxxxxxxxx </a>