LKML Archive on lore.kernel.org
help / color / mirror / Atom feed
From: Michal Hocko <mhocko@kernel.org>
To: "Huang, Ying" <ying.huang@intel.com>
Cc: Andrew Morton <akpm@linux-foundation.org>,
	linux-mm@kvack.org, linux-kernel@vger.kernel.org,
	Minchan Kim <minchan@kernel.org>,
	Johannes Weiner <hannes@cmpxchg.org>,
	Dave Hansen <dave.hansen@intel.com>,
	Hugh Dickins <hughd@google.com>
Subject: Re: [PATCH -mm] mm: Fix race between swapoff and mincore
Date: Fri, 16 Mar 2018 13:37:37 +0100	[thread overview]
Message-ID: <20180316123737.GJ23100@dhcp22.suse.cz> (raw)
In-Reply-To: <20180313012036.1597-1-ying.huang@intel.com>

On Tue 13-03-18 09:20:36, Huang, Ying wrote:
> From: Huang Ying <ying.huang@intel.com>
> 
> >From commit 4b3ef9daa4fc ("mm/swap: split swap cache into 64MB
> trunks") on, after swapoff, the address_space associated with the swap
> device will be freed.  So swap_address_space() users which touch the
> address_space need some kind of mechanism to prevent the address_space
> from being freed during accessing.
> 
> When mincore process unmapped range for swapped shmem pages, it
> doesn't hold the lock to prevent swap device from being swapoff.  So
> the following race is possible,
> 
> CPU1					CPU2
> do_mincore()				swapoff()
>   walk_page_range()
>     mincore_unmapped_range()
>       __mincore_unmapped_range
>         mincore_page
> 	  as = swap_address_space()
>           ...				  exit_swap_address_space()
>           ...				    kvfree(spaces)
> 	  find_get_page(as)
> 
> The address space may be accessed after being freed.
> 
> To fix the race, get_swap_device()/put_swap_device() is used to
> enclose find_get_page() to check whether the swap entry is valid and
> prevent the swap device from being swapoff during accessing.
> 
> Signed-off-by: "Huang, Ying" <ying.huang@intel.com>

Fixes: 4b3ef9daa4fc ("mm/swap: split swap cache into 64MB  trunks")

> Cc: Minchan Kim <minchan@kernel.org>
> Cc: Michal Hocko <mhocko@suse.com>
> Cc: Johannes Weiner <hannes@cmpxchg.org>
> Cc: Dave Hansen <dave.hansen@intel.com>
> Cc: Hugh Dickins <hughd@google.com>

Acked-by: Michal Hocko <mhocko@suse.com>

> ---
>  mm/mincore.c | 12 ++++++++++--
>  1 file changed, 10 insertions(+), 2 deletions(-)
> 
> diff --git a/mm/mincore.c b/mm/mincore.c
> index fc37afe226e6..a66f2052c7b1 100644
> --- a/mm/mincore.c
> +++ b/mm/mincore.c
> @@ -68,8 +68,16 @@ static unsigned char mincore_page(struct address_space *mapping, pgoff_t pgoff)
>  		 */
>  		if (radix_tree_exceptional_entry(page)) {
>  			swp_entry_t swp = radix_to_swp_entry(page);
> -			page = find_get_page(swap_address_space(swp),
> -					     swp_offset(swp));
> +			struct swap_info_struct *si;
> +
> +			/* Prevent swap device to being swapoff under us */
> +			si = get_swap_device(swp);
> +			if (si) {
> +				page = find_get_page(swap_address_space(swp),
> +						     swp_offset(swp));
> +				put_swap_device(si);
> +			} else
> +				page = NULL;
>  		}
>  	} else
>  		page = find_get_page(mapping, pgoff);
> -- 
> 2.15.1
> 

-- 
Michal Hocko
SUSE Labs

  reply	other threads:[~2018-03-16 12:37 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-03-13  1:20 Huang, Ying
2018-03-16 12:37 ` Michal Hocko [this message]
2019-05-23  8:53 [PATCH -mm] mm: fix " Huang, Ying

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20180316123737.GJ23100@dhcp22.suse.cz \
    --to=mhocko@kernel.org \
    --cc=akpm@linux-foundation.org \
    --cc=dave.hansen@intel.com \
    --cc=hannes@cmpxchg.org \
    --cc=hughd@google.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-mm@kvack.org \
    --cc=minchan@kernel.org \
    --cc=ying.huang@intel.com \
    --subject='Re: [PATCH -mm] mm: Fix race between swapoff and mincore' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).