BUG? misused atomic instructions in mm/swapfile.c

["홍신 shin hong" <hongshin@gmail.com>]

Hello. I am reporting atomic instructions usages
which are suspected to be misused in mm/swapfile.c
of Linux 2.6.30.5.

I do not have much background on mm
so that I am not certain whether it is correct or not.
But I hope this report is helpful. Please examine the code.

In try_to_use(), setup_swap_extents(), and SYSCALL_DEFINE2(),
there are following codes:

    if (atomic_read(&start_mm->mm_users) == 1) {
        mmput(start_mm) ;
        start_mm = &init_mm ;
        atomic_inc(&init_mm.mm_users) ;
    }

It first checks start_mm->mm_users and then increments its value by one.

If one of these functions is executed in two different threads
for the same start_mm concurrently,
mmput(start_mm) can be executed twice as result of race.

I think it would be better to combine two atomic operations
into one atomic operation (e.g. atomic_cmpxchg).

Thank you.

Sincerely
Shin Hong

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>