They all eminate from the fact that the swapping out of vma's within
an mm occur with no locking, and thus no guarentees of safety, of that
address space.
The real fix is the make swapping grab the mmap semaphore, or at least
do _something_ which prevents:
kswapd process
choose vma
pick page to swap out
rw_swap_page()
sleep
munmap(vma);
flush_tlb_page(vma, page);
OOPS vma no longer exists!
The current code makes no effort to try and prevent this situation
from occuring. Fix this, and you'll fix a lot of races inherent in
the current swapping code.
Later,
David "Sparc" Miller
davem@caip.rutgers.edu