From patchwork Sat Nov 16 01:35:00 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrew Morton X-Patchwork-Id: 11247421 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id DC87F13BD for ; Sat, 16 Nov 2019 01:35:04 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id A97C5207DD for ; Sat, 16 Nov 2019 01:35:04 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=kernel.org header.i=@kernel.org header.b="ulW2qUbz" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org A97C5207DD Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=linux-foundation.org Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 4EC916B0266; Fri, 15 Nov 2019 20:35:03 -0500 (EST) Delivered-To: linux-mm-outgoing@kvack.org Received: by kanga.kvack.org (Postfix, from userid 40) id 4738D6B0269; Fri, 15 Nov 2019 20:35:03 -0500 (EST) X-Original-To: int-list-linux-mm@kvack.org X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 388BE6B026A; Fri, 15 Nov 2019 20:35:03 -0500 (EST) X-Original-To: linux-mm@kvack.org X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0253.hostedemail.com [216.40.44.253]) by kanga.kvack.org (Postfix) with ESMTP id 2088F6B0266 for ; Fri, 15 Nov 2019 20:35:03 -0500 (EST) Received: from smtpin18.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay04.hostedemail.com (Postfix) with SMTP id ECA065DD8 for ; Sat, 16 Nov 2019 01:35:02 +0000 (UTC) X-FDA: 76160422044.18.cub00_eee8eddf8b27 X-Spam-Summary: 2,0,0,9f68d807e76f0d38,d41d8cd98f00b204,akpm@linux-foundation.org,:akpm@linux-foundation.org:hughd@google.com::mhocko@suse.com:minchan@google.com:minchan@kernel.org:mm-commits@vger.kernel.org:stable@vger.kernel.org:torvalds@linux-foundation.org:vinmenon@codeaurora.org,RULES_HIT:41:355:379:800:960:965:966:967:973:988:989:1042:1260:1263:1345:1381:1431:1437:1534:1542:1711:1730:1747:1777:1792:1801:2196:2199:2393:2525:2559:2563:2682:2685:2859:2902:2933:2937:2939:2942:2945:2947:2951:2954:3022:3138:3139:3140:3141:3142:3353:3865:3866:3867:3868:3870:3871:3872:3874:3934:3936:3938:3941:3944:3947:3950:3953:3956:3959:4250:4321:4385:4390:4395:4605:5007:6261:6653:7558:7576:7903:8540:8957:9025:9121:9391:9545:10004:10128:10913:11026:11233:11658:11914:12043:12048:12296:12297:12438:12517:12519:12555:12679:12783:12986:13161:13229:13846:14181:14721:14849:14877:21080:21324:21433:21451:21627:21772:21795:21819:21939:30003:30051:30054,0,RBL:error,CacheIP:none,Bayesian:0.5,0.5,0.5,Netc heck:non X-HE-Tag: cub00_eee8eddf8b27 X-Filterd-Recvd-Size: 4005 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by imf15.hostedemail.com (Postfix) with ESMTP for ; Sat, 16 Nov 2019 01:35:02 +0000 (UTC) Received: from localhost.localdomain (c-73-231-172-41.hsd1.ca.comcast.net [73.231.172.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 4837820815; Sat, 16 Nov 2019 01:35:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1573868101; bh=Kv1yug5QUnHpKv2L6ZJuYSuJkNFgsyaXFiTSn61696s=; h=Date:From:To:Subject:From; b=ulW2qUbzXU+hkBZG8iumBZIngX+2AsIu8MFJQRZgrbIrYJcSyz8Nonp32scefcPZF qCa4jvygr6f7Y0oul4xV95FUdKSxqo1o/m6qlSBzrUWAngoERBC8BpwkhC+FAjBXbx QEqmp4WUZKmzgZzBjteu2Wl7NXUGzOY0gYVkgnEY= Date: Fri, 15 Nov 2019 17:35:00 -0800 From: akpm@linux-foundation.org To: akpm@linux-foundation.org, hughd@google.com, linux-mm@kvack.org, mhocko@suse.com, minchan@google.com, minchan@kernel.org, mm-commits@vger.kernel.org, stable@vger.kernel.org, torvalds@linux-foundation.org, vinmenon@codeaurora.org Subject: [patch 09/11] mm/page_io.c: do not free shared swap slots Message-ID: <20191116013500.fmyyvsUau%akpm@linux-foundation.org> User-Agent: s-nail v14.8.16 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: From: Vinayak Menon Subject: mm/page_io.c: do not free shared swap slots The following race is observed due to which a processes faulting on a swap entry, finds the page neither in swapcache nor swap. This causes zram to give a zero filled page that gets mapped to the process, resulting in a user space crash later. Consider parent and child processes Pa and Pb sharing the same swap slot with swap_count 2. Swap is on zram with SWP_SYNCHRONOUS_IO set. Virtual address 'VA' of Pa and Pb points to the shared swap entry. Pa Pb fault on VA fault on VA do_swap_page do_swap_page lookup_swap_cache fails lookup_swap_cache fails Pb scheduled out swapin_readahead (deletes zram entry) swap_free (makes swap_count 1) Pb scheduled in swap_readpage (swap_count == 1) Takes SWP_SYNCHRONOUS_IO path zram enrty absent zram gives a zero filled page Fix this by making sure that swap slot is freed only when swap count drops down to one. Link: http://lkml.kernel.org/r/1571743294-14285-1-git-send-email-vinmenon@codeaurora.org Fixes: aa8d22a11da9 ("mm: swap: SWP_SYNCHRONOUS_IO: skip swapcache only if swapped page has no other reference") Signed-off-by: Vinayak Menon Suggested-by: Minchan Kim Acked-by: Minchan Kim Cc: Michal Hocko Cc: Hugh Dickins Cc: Signed-off-by: Andrew Morton --- mm/page_io.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) --- a/mm/page_io.c~mm-do-not-free-shared-swap-slots +++ a/mm/page_io.c @@ -73,6 +73,7 @@ static void swap_slot_free_notify(struct { struct swap_info_struct *sis; struct gendisk *disk; + swp_entry_t entry; /* * There is no guarantee that the page is in swap cache - the software @@ -104,11 +105,10 @@ static void swap_slot_free_notify(struct * we again wish to reclaim it. */ disk = sis->bdev->bd_disk; - if (disk->fops->swap_slot_free_notify) { - swp_entry_t entry; + entry.val = page_private(page); + if (disk->fops->swap_slot_free_notify && __swap_count(entry) == 1) { unsigned long offset; - entry.val = page_private(page); offset = swp_offset(entry); SetPageDirty(page);