Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
[PATCH] i386: Fix race in iounmap
We need to hold the vmlist_lock while doing change_page_attr, otherwise we
could reset someone else's mapping.
Requires previous patch to add __remove_vm_area
Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
authored by
Andi Kleen
and committed by
Linus Torvalds
40579236
7856dfeb
+6
-4
+6
-4
arch/i386/mm/ioremap.c
+6
-4
arch/i386/mm/ioremap.c
···
238
238
addr < phys_to_virt(ISA_END_ADDRESS))
239
239
return;
240
240
241
-
p = remove_vm_area((void *) (PAGE_MASK & (unsigned long __force) addr));
241
+
write_lock(&vmlist_lock);
242
+
p = __remove_vm_area((void *) (PAGE_MASK & (unsigned long __force) addr));
242
243
if (!p) {
243
-
printk("__iounmap: bad address %p\n", addr);
244
-
return;
244
+
printk("iounmap: bad address %p\n", addr);
245
+
goto out_unlock;
245
246
}
246
247
247
248
if ((p->flags >> 20) && p->phys_addr < virt_to_phys(high_memory) - 1) {
248
-
/* p->size includes the guard page, but cpa doesn't like that */
249
249
change_page_attr(virt_to_page(__va(p->phys_addr)),
250
250
p->size >> PAGE_SHIFT,
251
251
PAGE_KERNEL);
252
252
global_flush_tlb();
253
253
}
254
+
out_unlock:
255
+
write_unlock(&vmlist_lock);
254
256
kfree(p);
255
257
}
256
258