Repository files (latest commit first)

Filename	Latest commit message	Latest commit date
Nick Piggin 945754a175 mm: fix race in COW logic ... There is a race in the COW logic. It contains a shortcut to avoid the COW and reuse the page if we have the sole reference on the page, however it is possible to have two racing do_wp_page()ers with one causing the other to mistakenly believe it is safe to take the shortcut when it is not. This could lead to data corruption. Process 1 and process2 each have a wp pte of the same anon page (ie. one forked the other). The page's mapcount is 2. Then they both attempt to write to it around the same time... proc1 proc2 thr1 proc2 thr2 CPU0 CPU1 CPU3 do_wp_page() do_wp_page() trylock_page() can_share_swap_page() load page mapcount (==2) reuse = 0 pte unlock copy page to new_page pte lock page_remove_rmap(page); trylock_page() can_share_swap_page() load page mapcount (==1) reuse = 1 ptep_set_access_flags (allow W) write private key into page read from page ptep_clear_flush() set_pte_at(pte of new_page) Fix this by moving the page_remove_rmap of the old page after the pte clear and flush. Potentially the entire branch could be moved down here, but in order to stay consistent, I won't (should probably move all the *_mm_counter stuff with one patch). Signed-off-by: Nick Piggin <npiggin@suse.de> Acked-by: Hugh Dickins <hugh@veritas.com> Cc: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>		2008-06-23 11:28:32 -07:00
..
allocpercpu.c	cpumask: Cleanup more uses of CPU_MASK and NODE_MASK	2008-04-19 19:44:58 +02:00
backing-dev.c	mm: bdi: fix race in bdi_class device creation	2008-05-20 13:31:53 -07:00
bootmem.c	Add return value to reserve_bootmem_node()	2008-06-21 11:25:10 -07:00
bounce.c
dmapool.c	dmapool: enable debugging for CONFIG_SLUB_DEBUG_ON too	2008-04-28 08:58:20 -07:00
fadvise.c	xip: support non-struct page backed memory	2008-04-28 08:58:23 -07:00
filemap.c	mm: fix infinite loop in filemap_fault	2008-05-14 19:11:13 -07:00
filemap_xip.c	xip: support non-struct page backed memory	2008-04-28 08:58:23 -07:00
fremap.c	mm: fix various kernel-doc comments	2008-03-19 18:53:35 -07:00
highmem.c	mm: highmem kernel-doc additions	2008-03-19 18:53:35 -07:00
hugetlb.c	hugetlb: fix lockdep error	2008-06-06 11:29:09 -07:00
internal.h	memory hotplug: free memmaps allocated by bootmem	2008-04-28 08:58:26 -07:00
Kconfig	PAGEFLAGS_EXTENDED and separate page flags for Head and Tail	2008-04-28 08:58:22 -07:00
maccess.c	kgdb: fix optional arch functions and probe_kernel_*	2008-04-17 20:05:39 +02:00
madvise.c	xip: support non-struct page backed memory	2008-04-28 08:58:23 -07:00
Makefile	uaccess: add probe_kernel_write()	2008-04-17 20:05:36 +02:00
memcontrol.c	memcg: simple stats for memory resource controller	2008-05-01 08:04:02 -07:00
memory.c	mm: fix race in COW logic	2008-06-23 11:28:32 -07:00
memory_hotplug.c	memory_hotplug: always initialize pageblock bitmap	2008-05-14 19:11:15 -07:00
mempolicy.c	mempolicy: use struct mempolicy pointer in shmem_sb_info	2008-04-28 08:58:25 -07:00
mempool.c
migrate.c	Reinstate ZERO_PAGE optimization in 'get_user_pages()' and fix XIP	2008-06-20 11:18:25 -07:00
mincore.c	mm: remove nopage	2008-04-28 08:58:18 -07:00
mlock.c
mmap.c	brk: make sys_brk() honor COMPAT_BRK when computing lower bound	2008-06-06 11:29:09 -07:00
mmzone.c	mm: filter based on a nodemask as well as a gfp_mask	2008-04-28 08:58:19 -07:00
mprotect.c	mprotect: prevent alteration of the PAT bits	2008-05-14 19:11:15 -07:00
mremap.c
msync.c
nommu.c	nommu: Correct kobjsize() page validity checks.	2008-06-12 07:56:17 -07:00
oom_kill.c	oom_kill: remove unused parameter in badness()	2008-04-28 08:58:26 -07:00
page-writeback.c	mm: Add NR_WRITEBACK_TEMP counter	2008-04-30 08:29:50 -07:00
page_alloc.c	mm: Minor clean-up of page flags in mm/page_alloc.c	2008-06-09 10:22:24 -07:00
page_io.c	mm: fix PageUptodate data race	2008-02-05 09:44:19 -08:00
page_isolation.c
pagewalk.c	pagemap: pass mm into pagewalkers	2008-06-12 18:05:41 -07:00
pdflush.c	mm/pdflush.c: merge the same code in two path	2008-05-13 08:02:24 -07:00
prio_tree.c
quicklist.c	quicklists: Only consider memory that can be used with GFP_KERNEL	2008-01-14 08:52:22 -08:00
readahead.c	mm: bdi: export BDI attributes in sysfs	2008-04-30 08:29:49 -07:00
rmap.c	mm: remove nopage	2008-04-28 08:58:18 -07:00
shmem.c	mm: bdi: add separate writeback accounting capability	2008-04-30 08:29:50 -07:00
shmem_acl.c
slab.c	Slab: Fix memory leak in fallback_alloc()	2008-06-21 16:51:02 -07:00
slob.c	slob: Fix to return wrong pointer	2008-05-19 20:55:25 +03:00
slub.c	slub: ksize() abuse checks	2008-05-22 19:52:18 +03:00
sparse-vmemmap.c	NULL noise: fs/*, mm/*, kernel/*	2008-03-30 14:18:41 -07:00
sparse.c	revert "memory hotplug: allocate usemap on the section with pgdat"	2008-04-30 08:29:55 -07:00
swap.c	mm: fix atomic_t overflow in vm	2008-05-24 09:56:09 -07:00
swap_state.c	mm: bdi: add separate writeback accounting capability	2008-04-30 08:29:50 -07:00
swapfile.c	mm: use non-racy method for /proc/swaps creation	2008-04-29 08:06:20 -07:00
thrash.c
tiny-shmem.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6	2008-03-25 08:57:47 -07:00
truncate.c	fix invalidate_inode_pages2_range() to not clear ret	2008-04-28 08:58:18 -07:00
util.c
vmalloc.c	docbook: fix vmalloc missing parameter notation	2008-05-01 08:03:59 -07:00
vmscan.c	mm: fix incorrect variable type in do_try_to_free_pages()	2008-06-12 18:05:39 -07:00
vmstat.c	make vmstat cpu-unplug safe	2008-05-13 08:02:23 -07:00