Heh. This is the same logic I just sent out. However:
RCU should guarantee that this spin_lock() is valid, but:
We're not guaranteed that the 'anon_vma->head' list is non-empty.
Somebody could have freed the list and the anon_vma and we have a stale
'page->anon_vma' (that has just not been _released_ yet).
And shouldn't that be 'list_first_entry'? Or &anon_vma->head.next?
How did that line actually work for you? Or was it just a "it boots", but
no actual testing of the rmap walk?
Linus
--