Messages in this thread |  | | | Date | Fri, 8 Jun 2012 12:03:58 +0200 | | From | Oleg Nesterov <> | | Subject | Re: [PATCH 3/3] uprobes: write_opcode()->__replace_page() can race with try_to_unmap() |
| |
On 06/08, Peter Zijlstra wrote: > > On Thu, 2012-06-07 at 19:00 +0200, Oleg Nesterov wrote: > > write_opcode() gets old_page via get_user_pages() and then calls > > __replace_page() which assumes that this old_page is still mapped > > after pte_offset_map_lock(). > > > > This is not true if this old_page was already try_to_unmap()'ed, > > and in this case everything __replace_page() does with old_page > > is wrong. Just for example, put_page() is not balanced. > > > > I think it is possible to teach __replace_page() to handle this > > unlikely case correctly, but this patch simply changes it to use > > page_check_address() and return -EAGAIN if it fails. The caller > > should notice this error code and retry. > > Note that replace_page() was nicked from ksm, does that suffer a similar > problem?
Yes, I looked at replace_page() too. Afaics it looks fine, it does the additional pte_same(pte, orig_pte) check.
Oleg.
|  |