]> Pileus Git - ~andy/linux/commit
uprobes: Write_opcode()->__replace_page() can race with try_to_unmap()
authorOleg Nesterov <oleg@redhat.com>
Fri, 15 Jun 2012 15:43:28 +0000 (17:43 +0200)
committerIngo Molnar <mingo@kernel.org>
Sat, 16 Jun 2012 07:10:42 +0000 (09:10 +0200)
commit5323ce71e4b4e1f188ebbc0cc7776885ea6c75fb
treefd4f1445cd71a2a2cc0096f08a216e27bc3fc237
parentcc359d180fa9c25a4c1819f17e07a422d788353d
uprobes: Write_opcode()->__replace_page() can race with try_to_unmap()

write_opcode() gets old_page via get_user_pages() and then calls
__replace_page() which assumes that this old_page is still
mapped after pte_offset_map_lock().

This is not true if this old_page was already try_to_unmap()'ed,
and in this case everything __replace_page() does with old_page
is wrong. Just for example, put_page() is not balanced.

I think it is possible to teach __replace_page() to handle this
unlikely case correctly, but this patch simply changes it to use
page_check_address() and return -EAGAIN if it fails. The caller
should notice this error code and retry.

Note: write_opcode() asks for the cleanups, I'll try to do this
in a separate patch.

Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Acked-by: Srikar Dronamraju <srikar@linux.vnet.ibm.com>
Cc: Ananth N Mavinakayanahalli <ananth@in.ibm.com>
Cc: Anton Arapov <anton@redhat.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Link: http://lkml.kernel.org/r/20120615154328.GA9571@redhat.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
kernel/events/uprobes.c