> I have one scenario, may you take into account: > > If one copyin case occurs, write() returned by your patch, the user process > may > check the return values, for errors, it may exit the process, then the error > page > will be freed, and then the page maybe alloced to other process or to kernel > itself, > then code will initialize it and this will trigger one SRAO, if it's used by > kernel, > we may do nothing for this, and kernel may still touch it, and lead to one > panic.
In this case kill_me_never() calls memory_failure() with flags == 0. I think (hope!) that means that it will unmap the page from the task, but will not send a signal. When the task exits the PTE for this page has the swap/poison signature, so the page is not freed for re-use. -Tony
