Messages in this thread Patch in this message | | | Subject | [PATCH 02 of 11] get_task_mm | Date | Wed, 07 May 2008 16:35:52 +0200 | From | Andrea Arcangeli <> |
| |
# HG changeset patch # User Andrea Arcangeli <andrea@qumranet.com> # Date 1210115127 -7200 # Node ID c5badbefeee07518d9d1acca13e94c981420317c # Parent e20917dcc8284b6a07cfcced13dda4cbca850a9c get_task_mm
get_task_mm should not succeed if mmput() is running and has reduced the mm_users count to zero. This can occur if a processor follows a tasks pointer to an mm struct because that pointer is only cleared after the mmput().
If get_task_mm() succeeds after mmput() reduced the mm_users to zero then we have the lovely situation that one portion of the kernel is doing all the teardown work for an mm while another portion is happily using it.
Signed-off-by: Christoph Lameter <clameter@sgi.com> Signed-off-by: Andrea Arcangeli <andrea@qumranet.com>
diff --git a/kernel/fork.c b/kernel/fork.c --- a/kernel/fork.c +++ b/kernel/fork.c @@ -465,7 +465,8 @@ struct mm_struct *get_task_mm(struct tas if (task->flags & PF_BORROWED_MM) mm = NULL; else - atomic_inc(&mm->mm_users); + if (!atomic_inc_not_zero(&mm->mm_users)) + mm = NULL; } task_unlock(task); return mm;
| |