• Andrew Morton's avatar
    [PATCH] mremap NULL pointer dereference fix · 584f5bcb
    Andrew Morton authored
    This is a cleaned-up version of a mremap() fix for "move_one_page()"
    by Rajesh Venkatasubramanian <vrajesh@umich.edu>. We could use a NULL
    "src" pointer.
    
    Because while we do hold the MM semaphore over the whole sequence, the
    destination page table allocation will possibly drop the page table
    spinlock.  That in turn can cause a clean source page to be stolen by
    page reclaim, causing the source-side "get_one_pte_map_nested()" to
    return NULL the second time around even if it didn't on the first case.
    
    So we just check "src" again, and get rid of the bogus TLB invalidate
    while we're at it.
    584f5bcb
mremap.c 11.5 KB