| commit | c3704ceb4ad055b489b143f4e37c57d128908012 | |
| author | Hugh Dickins <hugh@veritas.com> | |
| Sat, 10 Feb 2007 09:43:00 +0000 (10 01:43 -0800) | ||
| committer | Linus Torvalds <torvalds@woody.linux-foundation.org> | |
| Sun, 11 Feb 2007 18:51:17 +0000 (11 10:51 -0800) | ||
| tree | 730892c9d4d9dbab03c77597e822a7cb79c9cd96 | treesnapshot (tar.gz zip) |
| parent | f05b6284ee5d3be51ebe22284fc4b25fc586f380 | commitdiff |
[PATCH] page_mkwrite caller race fix
After do_wp_page has tested page_mkwrite, it must release old_page after
acquiring page table lock, not before: at some stage that ordering got
reversed, leaving a (very unlikely) window in which old_page might be
truncated, freed, and reused in the same position.
Signed-off-by: Hugh Dickins <hugh@veritas.com>
Acked-by: Nick Piggin <nickpiggin@yahoo.com.au>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
After do_wp_page has tested page_mkwrite, it must release old_page after
acquiring page table lock, not before: at some stage that ordering got
reversed, leaving a (very unlikely) window in which old_page might be
truncated, freed, and reused in the same position.
Signed-off-by: Hugh Dickins <hugh@veritas.com>
Acked-by: Nick Piggin <nickpiggin@yahoo.com.au>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
| mm/memory.c | diffblobblamehistory |