Re: [PATCH] hold cow while breaking

[Hugh Dickins]

On Sun, 29 Jul 2001, Linus Torvalds wrote:
> On Sun, 29 Jul 2001, Hugh Dickins wrote:
> >
> > do_wp_page() COW breaking is now very slightly unsafe.  Please don't
> > ask me to provide a test case! but the pte_same() check after regetting
> > page_table_lock is not quite enough to guarantee that the old_page was
> > not reaped, reused for something else, copy_cow_paged while containing
> > that other data, freed and then reused for precisely its original pte.
> 
> Oh, but it is.
> 
> We do hold the MM semaphore over the whole sequence, so there's no way the
> page table entry can be replaced by anything else than a non-present one
> (ie vmscan can swap it out, but nothing can swap it in because of the
> lock).

Sorry for being dense, but I still don't get it.  I thought the
down_read on mmap_sem is permitting concurrent faults by other users
of the address space (but excluding structural changes to the address
space)?  and we haven't locked the page itself, and we've temporarily
dropped the page_table_lock.  I just don't see what lock prevents the
page from being refaulted in.

Hugh