On 08/04/2015 12:15 PM, Leonid Yegoshin wrote:
David, Did you observe this in real?
Yes. It is not hypothetical.
The function __get_vm_area_node() allocates a guard page if flag VM_NO_GUARD is not used and I don't see any use of it in source. In past vmap allocated a guard page even unconditionally.
It has nothing to do with guard pages per se. The problem is if a vmap range (including guard page) ends on an even PFN. The buddy code will clobber the PTE for PFN+1. If another vmap operation is executing in set_pte() for the clobbered location, you can get corrupted page tables.
- Leonid.
