Messages in this thread | | | From | Andy Lutomirski <> | Date | Mon, 25 Nov 2013 15:30:26 -0800 | Subject | Race in check_stack_guard_page? |
| |
I was looking at the stack expansion code, and I'm not convinced it's safe. Aside from the obvious scariness of down_read(&mmap_sem) not actually preventing vma changes, I think there's a real race. Suppose that you have a VM_GROWSDOWN vma above a VM_GROWSUP vma with a single-page gap between them. Suppose further that they have different anon_vma roots.
If one ends up in expand_downwards and the other ends up in expand_upwards at the same time, then each one can take page_table_lock without re-checking that there's still room to expand. The result will be two vmas that share a page.
(This is presumably only possible on ia64.)
--Andy
| |