Re: [PATCH 2.5.66-mm2] Fix page_convert_anon locking issues

[Hugh Dickins]

On Wed, 2 Apr 2003, Dave McCracken wrote:
> --On Wednesday, April 02, 2003 15:38:45 -0800 Andrew Morton
> <[e-mail]> wrote:
> 
> > But:
> > 
> > +	/* Double check to make sure the pte page hasn't been freed */
> > +	if (!pmd_present(*pmd))
> > +		goto out_unmap;
> > +
> > 	==> munmap, pte page is freed, reallocated for pagecache, someone
> > 	    happens to write the correct value into it.
> > 	
> > +	if (page_to_pfn(page) != pte_pfn(*pte))
> > +		goto out_unmap;
> > +
> > +	if (addr)
> > +		*addr = address;
> > +
> 
> Oops.  The pmd_present() check should be after the page_to_pfn() !=
> pte_pfn() check.

No, you're forgetting that the case Andrew rightly indicates is
covered by the ptecount check I added to page_convert_anon, and
commented at length there.  As I said yesterday, I don't think
this "Double check" on *pmd serves any real purpose as coded
(whereas the earlier "Double check" on *pgd is vital).

Hugh