diff options
author | Michel Lespinasse <walken@google.com> | 2012-10-08 23:30:01 (GMT) |
---|---|---|
committer | Linus Torvalds <torvalds@linux-foundation.org> | 2012-10-09 07:22:28 (GMT) |
commit | ca42b26ab285edc5ee3f9faa48379d258db53c35 (patch) | |
tree | 4a9d68d4d730474dde75b1ffff106d7e3442aef1 /mm | |
parent | 227e4047488d3ee0173a914275a7fd207ad51e5b (diff) | |
download | linux-ca42b26ab285edc5ee3f9faa48379d258db53c35.tar.xz |
mm: fix potential anon_vma locking issue in mprotect()
Fix an anon_vma locking issue in the following situation:
- vma has no anon_vma
- next has an anon_vma
- vma is being shrunk / next is being expanded, due to an mprotect call
We need to take next's anon_vma lock to avoid races with rmap users (such
as page migration) while next is being expanded.
Signed-off-by: Michel Lespinasse <walken@google.com>
Reviewed-by: Andrea Arcangeli <aarcange@redhat.com>
Acked-by: Hugh Dickins <hughd@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'mm')
-rw-r--r-- | mm/mmap.c | 6 |
1 files changed, 5 insertions, 1 deletions
@@ -573,8 +573,12 @@ again: remove_next = 1 + (end > next->vm_end); */ if (vma->anon_vma && (importer || start != vma->vm_start)) { anon_vma = vma->anon_vma; + VM_BUG_ON(adjust_next && next->anon_vma && + anon_vma != next->anon_vma); + } else if (adjust_next && next->anon_vma) + anon_vma = next->anon_vma; + if (anon_vma) anon_vma_lock(anon_vma); - } if (root) { flush_dcache_mmap_lock(mapping); |