Question

I a possible race condition in a driver. Some of the clean up code that I expect to be ultimately by the munmap system call is getting called in exit_mmap (implemented in linux/mm/mmap.c). Immediately after the munmap call, an ioctl call is made. If the exit_mmap has not been made yet, the ioctl call returns an error.

So… under what conditions is exit_mmap called?

Answer 1

exit_mmap() is called when the last reference to an mm is put with mmput(). In the usual case, this happens when the last thread in a process exits or when a process successfully calls execve().