Re: msync() bug

[Andrea Arcangeli <andrea@suse.de>]

On Tue, Jul 10, 2001 at 12:43:12AM +1000, Andrew Morton wrote:
> Andrea Arcangeli wrote:
> > 
> > Wrong fix, `page' is just garbage if some non memory was mapped in
> > userspace (like framebuffers or similar mmio regions were mapped etc..).
> 
> Now we're getting somewhere.  Thanks.  Tell me if this is right:
>  
> 
> > if (VALID_PAGE(page)
> 
> If the physical address of the page is somewhere inside our
> working RAM.

correct.

> 
> > !PageReserved(page)
> 
> And it's not a reserved page (discontigmem?)

yes, but it's not discontigmem issue, it is the other way around (page
structure is valid but it maps to non ram, like the 640k-1M region that
we have the page structure for, we don't use discontigmem for it because
the hole is too smalle, but it is non ram, or also normal ram mapped by
some device as dma region).

> > ptep_test_and_clear_dirty(ptep))
> 
> And if it was modified via this mapping

yes.

> 
> > +                       flush_tlb_page(vma, address);
> > +                       set_page_dirty(page);
> 
> Question:  What happens if a program mmap's a part of /dev/mem
> which passes all of these tests?   Couldn't it then pick some

that cannot happen, remap_pte_range only maps invalid pages or reserved
pages.

> arbitrary member of mem_map[] which may or may not have
> a non-zero ->mapping?


Andrea