From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail172.messagelabs.com (mail172.messagelabs.com [216.82.254.3]) by kanga.kvack.org (Postfix) with SMTP id 7636E6B01AE for ; Mon, 15 Mar 2010 03:13:05 -0400 (EDT) Received: from m2.gw.fujitsu.co.jp ([10.0.50.72]) by fgwmail6.fujitsu.co.jp (Fujitsu Gateway) with ESMTP id o2F7D2Et030369 for (envelope-from kamezawa.hiroyu@jp.fujitsu.com); Mon, 15 Mar 2010 16:13:02 +0900 Received: from smail (m2 [127.0.0.1]) by outgoing.m2.gw.fujitsu.co.jp (Postfix) with ESMTP id 66FC645DE55 for ; Mon, 15 Mar 2010 16:13:02 +0900 (JST) Received: from s2.gw.fujitsu.co.jp (s2.gw.fujitsu.co.jp [10.0.50.92]) by m2.gw.fujitsu.co.jp (Postfix) with ESMTP id 4713245DE4E for ; Mon, 15 Mar 2010 16:13:02 +0900 (JST) Received: from s2.gw.fujitsu.co.jp (localhost.localdomain [127.0.0.1]) by s2.gw.fujitsu.co.jp (Postfix) with ESMTP id 264F91DB803C for ; Mon, 15 Mar 2010 16:13:02 +0900 (JST) Received: from ml14.s.css.fujitsu.com (ml14.s.css.fujitsu.com [10.249.87.104]) by s2.gw.fujitsu.co.jp (Postfix) with ESMTP id B7B47E38005 for ; Mon, 15 Mar 2010 16:13:01 +0900 (JST) Date: Mon, 15 Mar 2010 16:09:19 +0900 From: KAMEZAWA Hiroyuki Subject: Re: [PATCH 02/11] mm,migration: Do not try to migrate unmapped anonymous pages Message-Id: <20100315160919.c46fcc5a.kamezawa.hiroyu@jp.fujitsu.com> In-Reply-To: <20100315154459.c665f68d.kamezawa.hiroyu@jp.fujitsu.com> References: <1268412087-13536-1-git-send-email-mel@csn.ul.ie> <1268412087-13536-3-git-send-email-mel@csn.ul.ie> <28c262361003141728g4aa40901hb040144c5a4aeeed@mail.gmail.com> <20100315143420.6ec3bdf9.kamezawa.hiroyu@jp.fujitsu.com> <28c262361003142328w610f0478sbc17880ffa454fe8@mail.gmail.com> <20100315154459.c665f68d.kamezawa.hiroyu@jp.fujitsu.com> Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: owner-linux-mm@kvack.org To: KAMEZAWA Hiroyuki Cc: Minchan Kim , Mel Gorman , Andrew Morton , Andrea Arcangeli , Christoph Lameter , Adam Litke , Avi Kivity , David Rientjes , KOSAKI Motohiro , Rik van Riel , linux-kernel@vger.kernel.org, linux-mm@kvack.org List-ID: On Mon, 15 Mar 2010 15:44:59 +0900 KAMEZAWA Hiroyuki wrote: > On Mon, 15 Mar 2010 15:28:15 +0900 > Minchan Kim wrote: > > > On Mon, Mar 15, 2010 at 2:34 PM, KAMEZAWA Hiroyuki > > wrote: > > > On Mon, 15 Mar 2010 09:28:08 +0900 > > > Minchan Kim wrote: > > I think above scenario make error "use-after-free", again. > > What prevent above scenario? > > > I think this patch is not complete. > I guess this patch in [1/11] is trigger for the race. > == > + > + /* Drop an anon_vma reference if we took one */ > + if (anon_vma && atomic_dec_and_lock(&anon_vma->migrate_refcount, &anon_vma->lock)) { > + int empty = list_empty(&anon_vma->head); > + spin_unlock(&anon_vma->lock); > + if (empty) > + anon_vma_free(anon_vma); > + } > == > If my understainding in above is correct, this "modify" freed anon_vma. > Then, use-after-free happens. (In old implementation, there are no refcnt, > so, there is no use-after-free ops.) > Sorry, about above, my understanding was wrong. anon_vma->lock is modifed even in old code. Sorry for noise. -Kame -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: email@kvack.org