[Nouveau] [PATCHv2] kmmio/mmiotrace: fix double free of kmmio_fault_pages
marcin.slusarz at gmail.com
Sun Jun 13 15:18:03 PDT 2010
On Sun, Jun 13, 2010 at 11:56:54PM +0200, Marcin Slusarz wrote:
> After every iounmap mmiotrace has to free kmmio_fault_pages, but it
> can't do it directly, so it defers freeing by RCU.
> It usually works, but when mmiotraced code calls ioremap-iounmap
> multiple times without sleeping between (so RCU won't kick in and
> start freeing) it can be given the same virtual address, so at
> every iounmap mmiotrace will schedule the same pages for release.
> Obviously it will explode on second free.
> Fix it by marking kmmio_fault_pages which are scheduled for release
> and not adding them second time.
> Signed-off-by: Marcin Slusarz <marcin.slusarz at gmail.com>
> Acked-by: Pekka Paalanen <pq at iki.fi>
> Cc: Stuart Bennett <stuart at freedesktop.org>
> Tested-by: Marcin Kościelnicki <koriakin at 0x04.net>
> Tested-by: Shinpei KATO <shinpei at il.is.s.u-tokyo.ac.jp>
It would be good to apply it to -stable too. Sometimes people has to test
some earlier kernels because of unfixable constraints (you know, these
uncooperative vendors not releasing their binary drivers for latest kernels)
More information about the Nouveau