![]() | |||||||||||||
Messages in this thread |
Peter Staubach a écrit :
> --- linux-2.6.16.i686/mm/msync.c.org
> +++ linux-2.6.16.i686/mm/msync.c
> @@ -206,12 +206,16 @@ asmlinkage long sys_msync(unsigned long
> file = vma->vm_file;
> start = vma->vm_end;
> if ((flags & MS_ASYNC) && file && nr_pages_dirtied) {
> + struct address_space *mapping = file->f_mapping;
> +
> get_file(file);
> up_read(¤t->mm->mmap_sem);
> - balance_dirty_pages_ratelimited_nr(file->f_mapping,
> + balance_dirty_pages_ratelimited_nr(mapping,
> nr_pages_dirtied);
> fput(file);
<here>, another thread can perform an munmap(), and the file can be totally
dismantled.
> down_read(¤t->mm->mmap_sem);
So referencing 'mapping' is *buggy* here.
I believe that you have to move 'fput(file);' *after* the folloging two lines.
> + if (test_and_clear_bit(AS_MCTIME, &mapping->flags))
> + inode_update_time(mapping->host);
> vma = find_vma(current->mm, start);
> } else if ((flags & MS_SYNC) && file &&
> (vma->vm_flags & VM_SHARED)) {
Eric
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
| ||||||||||||
| Last update: 2006-05-31 21:41 [from the cache] ©2003-2008 | |||||||||||||