The patch titled
page_mkwrite caller race fix
has been added to the -mm tree. Its filename is
page_mkwrite-race-fix.patch
*** Remember to use Documentation/SubmitChecklist when testing your code ***
See http://www.zip.com.au/~akpm/linux/patches/stuff/added-to-mm.txt to find
out what to do about this
------------------------------------------------------
Subject: page_mkwrite caller race fix
From: Hugh Dickins <hugh@xxxxxxxxxxx>
After do_wp_page has tested page_mkwrite, it must release old_page after
acquiring page table lock, not before: at some stage that ordering got
reversed, leaving a (very unlikely) window in which old_page might be
truncated, freed, and reused in the same position.
Signed-off-by: Hugh Dickins <hugh@xxxxxxxxxxx>
Cc: Nick Piggin <nickpiggin@xxxxxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxx>
---
mm/memory.c | 3 +--
1 files changed, 1 insertion(+), 2 deletions(-)
diff -puN mm/memory.c~page_mkwrite-race-fix mm/memory.c
--- a/mm/memory.c~page_mkwrite-race-fix
+++ a/mm/memory.c
@@ -1531,8 +1531,6 @@ static int do_wp_page(struct mm_struct *
if (vma->vm_ops->page_mkwrite(vma, old_page) < 0)
goto unwritable_page;
- page_cache_release(old_page);
-
/*
* Since we dropped the lock we need to revalidate
* the PTE as someone else may have changed it. If
@@ -1541,6 +1539,7 @@ static int do_wp_page(struct mm_struct *
*/
page_table = pte_offset_map_lock(mm, pmd, address,
&ptl);
+ page_cache_release(old_page);
if (!pte_same(*page_table, orig_pte))
goto unlock;
}
_
Patches currently in -mm which might be from hugh@xxxxxxxxxxx are
origin.patch
dont-allow-the-stack-to-grow-into-hugetlb-reserved-regions.patch
page_mkwrite-race-fix.patch
fix-umask-when-noacl-kernel-meets-extn-tuned-for-acls.patch
ext2-reservations.patch
ext2-balloc-fix-_with_rsv-freeze.patch
ext2-balloc-reset-windowsz-when-full.patch
ext2-balloc-fix-off-by-one-against-rsv_end.patch
ext2-balloc-fix-off-by-one-against-grp_goal.patch
ext2-balloc-say-rb_entry-not-list_entry.patch
ext2-balloc-use-io_error-label.patch
-
To unsubscribe from this list: send the line "unsubscribe mm-commits" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
