Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 40579236 authored by Andi Kleen's avatar Andi Kleen Committed by Linus Torvalds
Browse files

[PATCH] i386: Fix race in iounmap 



We need to hold the vmlist_lock while doing change_page_attr, otherwise we
could reset someone else's mapping.

Requires previous patch to add __remove_vm_area

Signed-off-by: default avatarAndi Kleen <ak@suse.de>
Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
parent 7856dfeb

arch/i386/mm/ioremap.c

+6 −4
Original line number Diff line number Diff line
@@ -238,19 +238,21 @@ void iounmap(volatile void __iomem *addr) 
			addr < phys_to_virt(ISA_END_ADDRESS))

		return;



	p = remove_vm_area((void *) (PAGE_MASK & (unsigned long __force) addr));

	write_lock(&vmlist_lock);

	p = __remove_vm_area((void *) (PAGE_MASK & (unsigned long __force) addr));

	if (!p) { 

		printk("__iounmap: bad address %p\n", addr);

		return;

		printk("iounmap: bad address %p\n", addr);

		goto out_unlock;

	}



	if ((p->flags >> 20) && p->phys_addr < virt_to_phys(high_memory) - 1) {

		/* p->size includes the guard page, but cpa doesn't like that */

		change_page_attr(virt_to_page(__va(p->phys_addr)),

				 p->size >> PAGE_SHIFT,

				 PAGE_KERNEL);

		global_flush_tlb();

	} 

out_unlock:

	write_unlock(&vmlist_lock);

	kfree(p); 

}