mm: fix swapin race condition
authorAndrea Arcangeli <aarcange@redhat.com>
Thu, 9 Sep 2010 23:37:52 +0000 (16:37 -0700)
committerLinus Torvalds <torvalds@linux-foundation.org>
Fri, 10 Sep 2010 01:57:24 +0000 (18:57 -0700)
commit4969c1192d15afa3389e7ae3302096ff684ba655
treeabe560c8f293191be65488c49f4db3f3a626e63c
parent7c5367f205f7d53659fb19b9fdf65b7bc1a592c6
mm: fix swapin race condition

The pte_same check is reliable only if the swap entry remains pinned (by
the page lock on swapcache).  We've also to ensure the swapcache isn't
removed before we take the lock as try_to_free_swap won't care about the
page pin.

One of the possible impacts of this patch is that a KSM-shared page can
point to the anon_vma of another process, which could exit before the page
is freed.

This can leave a page with a pointer to a recycled anon_vma object, or
worse, a pointer to something that is no longer an anon_vma.

[riel@redhat.com: changelog help]
Signed-off-by: Andrea Arcangeli <aarcange@redhat.com>
Acked-by: Hugh Dickins <hughd@google.com>
Reviewed-by: Rik van Riel <riel@redhat.com>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
include/linux/ksm.h
mm/ksm.c
mm/memory.c