summaryrefslogtreecommitdiffstats
path: root/mm
diff options
context:
space:
mode:
authorHugh Dickins <hugh@veritas.com>2007-02-10 10:43:00 +0100
committerLinus Torvalds <torvalds@woody.linux-foundation.org>2007-02-11 19:51:17 +0100
commitc3704ceb4ad055b489b143f4e37c57d128908012 (patch)
tree730892c9d4d9dbab03c77597e822a7cb79c9cd96 /mm
parent[PATCH] typeof __page_to_pfn with SPARSEMEM=y (diff)
downloadlinux-c3704ceb4ad055b489b143f4e37c57d128908012.tar.xz
linux-c3704ceb4ad055b489b143f4e37c57d128908012.zip
[PATCH] page_mkwrite caller race fix
After do_wp_page has tested page_mkwrite, it must release old_page after acquiring page table lock, not before: at some stage that ordering got reversed, leaving a (very unlikely) window in which old_page might be truncated, freed, and reused in the same position. Signed-off-by: Hugh Dickins <hugh@veritas.com> Acked-by: Nick Piggin <nickpiggin@yahoo.com.au> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'mm')
-rw-r--r--mm/memory.c3
1 files changed, 1 insertions, 2 deletions
diff --git a/mm/memory.c b/mm/memory.c
index ef09f0acb1d8..0047d3a4e364 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -1531,8 +1531,6 @@ static int do_wp_page(struct mm_struct *mm, struct vm_area_struct *vma,
if (vma->vm_ops->page_mkwrite(vma, old_page) < 0)
goto unwritable_page;
- page_cache_release(old_page);
-
/*
* Since we dropped the lock we need to revalidate
* the PTE as someone else may have changed it. If
@@ -1541,6 +1539,7 @@ static int do_wp_page(struct mm_struct *mm, struct vm_area_struct *vma,
*/
page_table = pte_offset_map_lock(mm, pmd, address,
&ptl);
+ page_cache_release(old_page);
if (!pte_same(*page_table, orig_pte))
goto unlock;
}