A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-28 02:32:09 -04:00
Code Issues Projects Releases Packages Wiki Activity

[PATCH] mm: pte_offset_map_lock loops

Browse source 
Convert those common loops using page_table_lock on the outside and
pte_offset_map within to use just pte_offset_map_lock within instead.

These all hold mmap_sem (some exclusively, some not), so at no level can a
page table be whipped away from beneath them.  But whereas pte_alloc loops
tested with the "atomic" pmd_present, these loops are testing with pmd_none,
which on i386 PAE tests both lower and upper halves.

That's now unsafe, so add a cast into pmd_none to test only the vital lower
half: we lose a little sensitivity to a corrupt middle directory, but not
enough to worry about.  It appears that i386 and UML were the only
architectures vulnerable in this way, and pgd and pud no problem.

Signed-off-by: Hugh Dickins <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
This commit is contained in:
Hugh Dickins 2005-10-29 18:16:27 -07:00 • committed by Linus Torvalds
commit 705e87c0c3
7 changed files with 30 additions and 47 deletions
Download patch file Download diff file Expand all files Collapse all files

21
mm/msync.c
View file

@ -17,28 +17,22 @@
#include <asm/pgtable.h>
#include <asm/tlbflush.h>
/*
* Called with mm->page_table_lock held to protect against other
* threads/the swapper from ripping pte's out from under us.
*/
static void msync_pte_range(struct vm_area_struct *vma, pmd_t *pmd,
unsigned long addr, unsigned long end)
{
struct mm_struct *mm = vma->vm_mm;
pte_t *pte;
spinlock_t *ptl;
int progress = 0;
again:
pte = pte_offset_map(pmd, addr);
pte = pte_offset_map_lock(vma->vm_mm, pmd, addr, &ptl);
do {
unsigned long pfn;
struct page *page;
if (progress >= 64) {
progress = 0;
if (need_resched() ||
need_lockbreak(&mm->page_table_lock))
if (need_resched() || need_lockbreak(ptl))
break;
}
progress++;
@ -58,8 +52,8 @@ again:
set_page_dirty(page);
progress += 3;
} while (pte++, addr += PAGE_SIZE, addr != end);
pte_unmap(pte - 1);
cond_resched_lock(&mm->page_table_lock);
pte_unmap_unlock(pte - 1, ptl);
cond_resched();
if (addr != end)
goto again;
}
@ -97,7 +91,6 @@ static inline void msync_pud_range(struct vm_area_struct *vma, pgd_t *pgd,
static void msync_page_range(struct vm_area_struct *vma,
unsigned long addr, unsigned long end)
{
struct mm_struct *mm = vma->vm_mm;
pgd_t *pgd;
unsigned long next;
@ -110,16 +103,14 @@ static void msync_page_range(struct vm_area_struct *vma,
return;
BUG_ON(addr >= end);
pgd = pgd_offset(mm, addr);
pgd = pgd_offset(vma->vm_mm, addr);
flush_cache_range(vma, addr, end);
spin_lock(&mm->page_table_lock);
do {
next = pgd_addr_end(addr, end);
if (pgd_none_or_clear_bad(pgd))
continue;
msync_pud_range(vma, pgd, addr, next);
} while (pgd++, addr = next, addr != end);
spin_unlock(&mm->page_table_lock);
}
/*