On Sun, 6 Mar 2011, Kerin Millar wrote:
> Hi. Please consider the attached patch for the stable queues of the
> current LTS branches. Many thanks.

Yes, thank you Kerin, I support your request for it to go to stable.
It was my oversight not to Cc: [email protected] when I sent it in.
Though I doubt it's actually been responsible for anyone's page_mapped
BUGs, other than via fuzzer, it is nice to clear the air and believe
we have them all beat (until another shows up to spoil our party).

Hugh

commit a3e8cc643d22d2c8ed36b9be7d9c9ca21efcf7f7
Author: Hugh Dickins <[email protected]>
Date:   Wed Feb 23 21:39:49 2011 -0800

    mm: fix possible cause of a page_mapped BUG
    
    Robert Swiecki reported a BUG_ON(page_mapped) from a fuzzer, punching
    a hole with madvise(,, MADV_REMOVE).  That path is under mutex, and
    cannot be explained by lack of serialization in unmap_mapping_range().
    
    Reviewing the code, I found one place where vm_truncate_count handling
    should have been updated, when I switched at the last minute from one
    way of managing the restart_addr to another: mremap move changes the
    virtual addresses, so it ought to adjust the restart_addr.
    
    But rather than exporting the notion of restart_addr from memory.c, or
    converting to restart_pgoff throughout, simply reset vm_truncate_count
    to 0 to force a rescan if mremap move races with preempted truncation.
    
    We have no confirmation that this fixes Robert's BUG,
    but it is a fix that's worth making anyway.
    
    Signed-off-by: Hugh Dickins <[email protected]>
    Signed-off-by: Linus Torvalds <[email protected]>

diff --git a/mm/mremap.c b/mm/mremap.c
index 9925b63..1de98d4 100644
--- a/mm/mremap.c
+++ b/mm/mremap.c
@@ -94,9 +94,7 @@ static void move_ptes(struct vm_area_struct *vma, pmd_t 
*old_pmd,
                 */
                mapping = vma->vm_file->f_mapping;
                spin_lock(&mapping->i_mmap_lock);
-               if (new_vma->vm_truncate_count &&
-                   new_vma->vm_truncate_count != vma->vm_truncate_count)
-                       new_vma->vm_truncate_count = 0;
+               new_vma->vm_truncate_count = 0;
        }
 
        /*

_______________________________________________
stable mailing list
[email protected]
http://linux.kernel.org/mailman/listinfo/stable

Reply via email to