Messages in this thread |  | | | Date | Sun, 18 Mar 2012 22:23:21 +0000 | | From | Al Viro <> | | Subject | Re: [rfc][patches] fix for munmap/truncate races |
| |
On Sun, Mar 18, 2012 at 07:07:45PM +0000, Al Viro wrote: > Background: truncate() ends up going through the shared mappings > of file being truncated (under ->i_mmap_mutex, to protect them from > getting removed while we do that) and calling unmap_vmas() on them, > with range passed to unmap_vmas() sitting entirely within the vma > being passed to it. The trouble is, unmap_vmas() expects a chain of > vmas. It will look into the next vma, see that it's beyond the range > we'd been given and do nothing to it. Fine, except that there's nothing > to protect that next vma from being removed just as we do that - we do > *not* hold ->i_mmap and ->i_mmap_mutex held on our file won't do anything > to mappings that have nothing to do with the file in question. > There's an obvious way to deal with that - introducing a variant > of unmap_vmas() that would handle a single vma and switch these callers > of unmap_vmas() to using it. It requires some preparations; below is > the combined diff, for those who prefer to review the splitup, it is in > git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs.git #vm
BTW, the missing part of pull request:
Shortlog: Al Viro (6): VM: unmap_page_range() can return void VM: can't go through the inner loop in unmap_vmas() more than once... VM: make zap_page_range() return void VM: don't bother with feeding upper limit to tlb_finish_mmu() in exit_mmap() VM: make unmap_vmas() return void VM: make zap_page_range() callers that act on a single VMA use separate helper
Diffstat: include/linux/mm.h | 4 +- mm/memory.c | 133 +++++++++++++++++++++++++++++++--------------------- mm/mmap.c | 5 +- 3 files changed, 84 insertions(+), 58 deletions(-)
|  |