On Thu, Jun 7, 2012 at 12:03 AM, Greg KH [off-list ref] wrote:

3.4-stable review patch. �If anyone has any objections, please let me know.

------------------

From: Andrea Arcangeli <redacted>

commit 26c191788f18129af0eb32a358cdaea0c7479626 upstream.

When holding the mmap_sem for reading, pmd_offset_map_lock should only
run on a pmd_t that has been read atomically from the pmdp pointer,
otherwise we may read only half of it leading to this crash.

This one is important, but it can break Xen apparently:

http://permalink.gmane.org/gmane.comp.emulators.xen.devel/132522
https://bugzilla.redhat.com/show_bug.cgi?id=829016

Not sure if you want to hold off on it or see if Andrea comes up with
a follow up fix?

josh