From patchwork Sat Aug 20 03:25:06 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kefeng Wang X-Patchwork-Id: 12949443 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 57DADC25B08 for ; Sat, 20 Aug 2022 03:21:27 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 905308D0003; Fri, 19 Aug 2022 23:21:26 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 88C5B8D0002; Fri, 19 Aug 2022 23:21:26 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 72CD78D0003; Fri, 19 Aug 2022 23:21:26 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0017.hostedemail.com [216.40.44.17]) by kanga.kvack.org (Postfix) with ESMTP id 5EBD88D0002 for ; Fri, 19 Aug 2022 23:21:26 -0400 (EDT) Received: from smtpin15.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay07.hostedemail.com (Postfix) with ESMTP id 27F88160417 for ; Sat, 20 Aug 2022 03:21:26 +0000 (UTC) X-FDA: 79818520572.15.28031D7 Received: from szxga03-in.huawei.com (szxga03-in.huawei.com [45.249.212.189]) by imf26.hostedemail.com (Postfix) with ESMTP id 2B307140028 for ; Sat, 20 Aug 2022 03:19:35 +0000 (UTC) Received: from dggpemm500020.china.huawei.com (unknown [172.30.72.53]) by szxga03-in.huawei.com (SkyGuard) with ESMTP id 4M8kMn0dGyzGpfF; Sat, 20 Aug 2022 11:17:57 +0800 (CST) Received: from dggpemm500001.china.huawei.com (7.185.36.107) by dggpemm500020.china.huawei.com (7.185.36.49) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.24; Sat, 20 Aug 2022 11:19:32 +0800 Received: from localhost.localdomain.localdomain (10.175.113.25) by dggpemm500001.china.huawei.com (7.185.36.107) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.24; Sat, 20 Aug 2022 11:19:31 +0800 From: Kefeng Wang To: Andrew Morton , CC: Qian Cai , , Kefeng Wang Subject: [PATCH] mm: fix pgdat->kswap accessed concurrently Date: Sat, 20 Aug 2022 11:25:06 +0800 Message-ID: <20220820032506.126860-1-wangkefeng.wang@huawei.com> X-Mailer: git-send-email 2.35.3 MIME-Version: 1.0 X-Originating-IP: [10.175.113.25] X-ClientProxiedBy: dggems703-chm.china.huawei.com (10.3.19.180) To dggpemm500001.china.huawei.com (7.185.36.107) X-CFilter-Loop: Reflected ARC-Authentication-Results: i=1; imf26.hostedemail.com; dkim=none; spf=pass (imf26.hostedemail.com: domain of wangkefeng.wang@huawei.com designates 45.249.212.189 as permitted sender) smtp.mailfrom=wangkefeng.wang@huawei.com; dmarc=pass (policy=quarantine) header.from=huawei.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1660965576; a=rsa-sha256; cv=none; b=NOWyR9HyHFdMf29AvBZLS8IQ7N3QWL/OcKKUC8b5RQLZNLJmBPA4sdeO075cKBd9+lkpYb ZicEKSX/pyb9iwTv8BgeBmNTzfr+tvFlfl1wyLRGVoZMDiBfszoJDQ+yOfpCXrogGXyyST /yqE/DhqhLjZWNg7B8exdgxn4i/SPJg= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1660965576; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding:in-reply-to: references; bh=J7j9zXKd9L1TROwvqPO732oPMhzkKdKyL9heFMgG7Uc=; b=xyRMEaF3jGgX4HbudNB9mZUw272xPVQsgF0LZCI+xMH1L/RU2nUr8s0kM7m5015P6KuZdS CFtF3av+R+XvyT8mjnFLiY3RVgJgsNrtrjBezl5y16OHr4mv31qXrd9X7buvvLnRljklMJ iemcs9hH1jCmaUWYcj9SNad1VVg62ww= X-Rspam-User: Authentication-Results: imf26.hostedemail.com; dkim=none; spf=pass (imf26.hostedemail.com: domain of wangkefeng.wang@huawei.com designates 45.249.212.189 as permitted sender) smtp.mailfrom=wangkefeng.wang@huawei.com; dmarc=pass (policy=quarantine) header.from=huawei.com X-Rspamd-Server: rspam02 X-Stat-Signature: awjf491p53kajfajgkuh4qdo44u145r3 X-Rspamd-Queue-Id: 2B307140028 X-HE-Tag: 1660965575-488235 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: The pgdat->kswap could be accessed concurrently by kswapd_run() and kcompactd(), it don't be protected by any lock, which leads to the following null-ptr-deref, vmscan: Failed to start kswapd on node 0 ... BUG: KASAN: null-ptr-deref in kcompactd+0x440/0x504 Read of size 8 at addr 0000000000000024 by task kcompactd0/37 CPU: 0 PID: 37 Comm: kcompactd0 Kdump: loaded Tainted: G OE 5.10.60 #1 Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015 Call trace: dump_backtrace+0x0/0x394 show_stack+0x34/0x4c dump_stack+0x158/0x1e4 __kasan_report+0x138/0x140 kasan_report+0x44/0xdc __asan_load8+0x94/0xd0 kcompactd+0x440/0x504 kthread+0x1a4/0x1f0 ret_from_fork+0x10/0x18 Fix it by adding READ_ONCE()|WRITE_ONCE(). Signed-off-by: Kefeng Wang Reviewed-by: Muchun Song Reviewed-by: Muchun Song --- mm/compaction.c | 4 +++- mm/vmscan.c | 15 +++++++++------ 2 files changed, 12 insertions(+), 7 deletions(-) diff --git a/mm/compaction.c b/mm/compaction.c index 640fa76228dd..aa1cfe47f046 100644 --- a/mm/compaction.c +++ b/mm/compaction.c @@ -1983,7 +1983,9 @@ static inline bool is_via_compact_memory(int order) static bool kswapd_is_running(pg_data_t *pgdat) { - return pgdat->kswapd && task_is_running(pgdat->kswapd); + struct task_struct *t = READ_ONCE(pgdat->kswapd); + + return t && task_is_running(t); } /* diff --git a/mm/vmscan.c b/mm/vmscan.c index b2b1431352dc..9abba714249e 100644 --- a/mm/vmscan.c +++ b/mm/vmscan.c @@ -4642,16 +4642,19 @@ unsigned long shrink_all_memory(unsigned long nr_to_reclaim) void kswapd_run(int nid) { pg_data_t *pgdat = NODE_DATA(nid); + struct task_struct *t; - if (pgdat->kswapd) + if (READ_ONCE(pgdat->kswapd)) return; - pgdat->kswapd = kthread_run(kswapd, pgdat, "kswapd%d", nid); - if (IS_ERR(pgdat->kswapd)) { + t = kthread_run(kswapd, pgdat, "kswapd%d", nid); + if (IS_ERR(t)) { /* failure at boot is fatal */ BUG_ON(system_state < SYSTEM_RUNNING); pr_err("Failed to start kswapd on node %d\n", nid); - pgdat->kswapd = NULL; + WRITE_ONCE(pgdat->kswapd, NULL); + } else { + WRITE_ONCE(pgdat->kswapd, t); } } @@ -4661,11 +4664,11 @@ void kswapd_run(int nid) */ void kswapd_stop(int nid) { - struct task_struct *kswapd = NODE_DATA(nid)->kswapd; + struct task_struct *kswapd = READ_ONCE(NODE_DATA(nid)->kswapd); if (kswapd) { kthread_stop(kswapd); - NODE_DATA(nid)->kswapd = NULL; + WRITE_ONCE(NODE_DATA(nid)->kswapd, NULL); } }