From patchwork Tue Oct 22 11:21:34 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Vinayak Menon X-Patchwork-Id: 11204273 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 2F7711515 for ; Tue, 22 Oct 2019 11:21:54 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id E66BC21783 for ; Tue, 22 Oct 2019 11:21:53 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="key not found in DNS" (0-bit key) header.d=codeaurora.org header.i=@codeaurora.org header.b="Sndc3xOH"; dkim=fail reason="key not found in DNS" (0-bit key) header.d=codeaurora.org header.i=@codeaurora.org header.b="S8faB6BP" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org E66BC21783 Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=codeaurora.org Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 2052F6B0003; Tue, 22 Oct 2019 07:21:53 -0400 (EDT) Delivered-To: linux-mm-outgoing@kvack.org Received: by kanga.kvack.org (Postfix, from userid 40) id 18D556B0006; Tue, 22 Oct 2019 07:21:53 -0400 (EDT) X-Original-To: int-list-linux-mm@kvack.org X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 055B06B0007; Tue, 22 Oct 2019 07:21:53 -0400 (EDT) X-Original-To: linux-mm@kvack.org X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0203.hostedemail.com [216.40.44.203]) by kanga.kvack.org (Postfix) with ESMTP id D1D4D6B0003 for ; Tue, 22 Oct 2019 07:21:52 -0400 (EDT) Received: from smtpin07.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay01.hostedemail.com (Postfix) with SMTP id 722FF180AD817 for ; Tue, 22 Oct 2019 11:21:52 +0000 (UTC) X-FDA: 76071180864.07.fall15_2d63cfb4d6763 X-Spam-Summary: 50,0,0,69a9de7ec7f2a519,d41d8cd98f00b204,vinmenon@codeaurora.org,:minchan@kernel.org::kernel-team@android.com:vinmenon@codeaurora.org:mhocko@suse.com,RULES_HIT:41:355:379:541:800:960:965:966:973:988:989:1042:1260:1345:1437:1534:1542:1711:1730:1747:1777:1792:1801:2196:2199:2393:2540:2559:2562:3138:3139:3140:3141:3142:3353:3865:3866:3867:3868:3870:3871:3872:3874:4250:4385:4390:4395:4605:5007:6261:6653:7903:8540:8957:9121:10004:10128:11026:11218:11232:11233:11658:11914:12043:12296:12297:12438:12517:12519:12555:13161:13229:14096:14181:14394:14721:14877:21080:21324:21451:21627:21772:21795:21972:30003:30012:30051:30054,0,RBL:198.145.29.96-irl.urbl.hostedemail.com-127.0.0.150,CacheIP:none,Bayesian:0.5,0.5,0.5,Netcheck:none,DomainCache:0,MSF:not bulk,SPF:fp,MSBL:0,DNSBL:neutral,Custom_rules:0:0:0,LFtime:28,LUA_SUMMARY:none X-HE-Tag: fall15_2d63cfb4d6763 X-Filterd-Recvd-Size: 4778 Received: from smtp.codeaurora.org (smtp.codeaurora.org [198.145.29.96]) by imf15.hostedemail.com (Postfix) with ESMTP for ; Tue, 22 Oct 2019 11:21:51 +0000 (UTC) Received: by smtp.codeaurora.org (Postfix, from userid 1000) id D784960953; Tue, 22 Oct 2019 11:21:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=codeaurora.org; s=default; t=1571743310; bh=2MwnOAMyx702W+nY3yttIPQjwG8S5vWxhcER9as1yPA=; h=From:To:Cc:Subject:Date:From; b=Sndc3xOHMhD364+idedHbekMl4Z6dIT/Dy8WBdgIW40fOkGr/BTJhAHQyPukeRezj LvGWd438f4pSN3TMeHAS0dGfpyFzivuDOmxoDCJqLrMYWDmUf2hB/7Kn32bGw5AZLO xpqfA0AvdfzrwzKf4+sfdk0gtW+4bJEePIeuOLag= X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on pdx-caf-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-2.7 required=2.0 tests=ALL_TRUSTED,BAYES_00, DKIM_INVALID,DKIM_SIGNED,SPF_NONE autolearn=no autolearn_force=no version=3.4.0 Received: from vinmenon-linux.qualcomm.com (blr-c-bdr-fw-01_globalnat_allzones-outside.qualcomm.com [103.229.19.19]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-SHA256 (128/128 bits)) (No client certificate requested) (Authenticated sender: vinmenon@smtp.codeaurora.org) by smtp.codeaurora.org (Postfix) with ESMTPSA id 87C2B60779; Tue, 22 Oct 2019 11:21:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=codeaurora.org; s=default; t=1571743309; bh=2MwnOAMyx702W+nY3yttIPQjwG8S5vWxhcER9as1yPA=; h=From:To:Cc:Subject:Date:From; b=S8faB6BPidR39HqH2ReA91jsZkAdwR48pt81q/krBtdzJ/lFrV/sMHK4FqoqBoYKN qgEx2FWg7qg59u2gTEy6RPVyLoIxt0BGTKyYYkmyGhwsUa5BRFUOcAKDkPol1sxmAj x2+Bfq6kBFrMBaNvRt3pKDDC+Kss3JEr2B+210mY= DMARC-Filter: OpenDMARC Filter v1.3.2 smtp.codeaurora.org 87C2B60779 Authentication-Results: pdx-caf-mail.web.codeaurora.org; dmarc=none (p=none dis=none) header.from=codeaurora.org Authentication-Results: pdx-caf-mail.web.codeaurora.org; spf=none smtp.mailfrom=vinmenon@codeaurora.org From: Vinayak Menon To: minchan@kernel.org, linux-mm@kvack.org Cc: kernel-team@android.com, Vinayak Menon , Michal Hocko Subject: [PATCH] mm: do not free shared swap slots Date: Tue, 22 Oct 2019 16:51:34 +0530 Message-Id: <1571743294-14285-1-git-send-email-vinmenon@codeaurora.org> X-Mailer: git-send-email 2.7.4 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: The following race is observed due to which a processes faulting on a swap entry, finds the page neither in swapcache nor swap. This causes zram to give a zero filled page that gets mapped to the process, resulting in a user space crash later. Consider parent and child processes Pa and Pb sharing the same swap slot with swap_count 2. Swap is on zram with SWP_SYNCHRONOUS_IO set. Virtual address 'VA' of Pa and Pb points to the shared swap entry. Pa Pb fault on VA fault on VA do_swap_page do_swap_page lookup_swap_cache fails lookup_swap_cache fails Pb scheduled out swapin_readahead (deletes zram entry) swap_free (makes swap_count 1) Pb scheduled in swap_readpage (swap_count == 1) Takes SWP_SYNCHRONOUS_IO path zram enrty absent zram gives a zero filled page Fix this by making sure that swap slot is freed only when swap count drops down to one. Signed-off-by: Vinayak Menon Suggested-by: Minchan Kim Cc: Michal Hocko Acked-by: Minchan Kim --- mm/page_io.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/mm/page_io.c b/mm/page_io.c index 83db25a..3a198de 100644 --- a/mm/page_io.c +++ b/mm/page_io.c @@ -74,6 +74,7 @@ static void swap_slot_free_notify(struct page *page) { struct swap_info_struct *sis; struct gendisk *disk; + swp_entry_t entry; /* * There is no guarantee that the page is in swap cache - the software @@ -105,11 +106,10 @@ static void swap_slot_free_notify(struct page *page) * we again wish to reclaim it. */ disk = sis->bdev->bd_disk; - if (disk->fops->swap_slot_free_notify) { - swp_entry_t entry; + entry.val = page_private(page); + if (disk->fops->swap_slot_free_notify && __swap_count(entry) == 1) { unsigned long offset; - entry.val = page_private(page); offset = swp_offset(entry); SetPageDirty(page);