Re: Race between vmtruncate and mapped areas?

[Andrew Morton <akpm@digeo.com>]

Dave McCracken <dmccr@us.ibm.com> wrote:
>
> After some though it occurred to me there is a simple alternative scenario
>  that's not protected.  If a task is *already* in a page fault mapping the
>  page in, then vmtruncate() could call zap_page_range() before the page
>  fault completes.  When the page fault does complete the page will be mapped
>  into the area previously cleared by vmtruncate().

That's the one.  Process is sleeping on I/O in filemap_nopage(), wakes up
after the truncate has done its thing and the page gets instantiated in
pagetables.

But it's an anon page now.  So the application (which was racy anyway) gets
itself an anonymous page.

Which can still have buffers attached, which the swapout code needs to be
careful about.

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"aart@kvack.org"> aart@kvack.org </a>