diff options
| author | Michel Lespinasse <walken@google.com> | 2012-10-08 16:30:01 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2012-10-09 16:22:28 +0900 |
| commit | ca42b26ab285edc5ee3f9faa48379d258db53c35 (patch) | |
| tree | 4a9d68d4d730474dde75b1ffff106d7e3442aef1 /mm | |
| parent | 227e4047488d3ee0173a914275a7fd207ad51e5b (diff) | |
| download | linux-ca42b26ab285edc5ee3f9faa48379d258db53c35.tar.bz2 | |
mm: fix potential anon_vma locking issue in mprotect()
Fix an anon_vma locking issue in the following situation:
- vma has no anon_vma
- next has an anon_vma
- vma is being shrunk / next is being expanded, due to an mprotect call
We need to take next's anon_vma lock to avoid races with rmap users (such
as page migration) while next is being expanded.
Signed-off-by: Michel Lespinasse <walken@google.com>
Reviewed-by: Andrea Arcangeli <aarcange@redhat.com>
Acked-by: Hugh Dickins <hughd@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'mm')
| -rw-r--r-- | mm/mmap.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/mm/mmap.c b/mm/mmap.c index 2ba27434e843..e3c365ff1b6a 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -573,8 +573,12 @@ again: remove_next = 1 + (end > next->vm_end); */ if (vma->anon_vma && (importer || start != vma->vm_start)) { anon_vma = vma->anon_vma; + VM_BUG_ON(adjust_next && next->anon_vma && + anon_vma != next->anon_vma); + } else if (adjust_next && next->anon_vma) + anon_vma = next->anon_vma; + if (anon_vma) anon_vma_lock(anon_vma); - } if (root) { flush_dcache_mmap_lock(mapping); |