All of lore.kernel.org
 help / color / mirror / Atom feed
From: Minchan Kim <minchan@kernel.org>
To: Michal Hocko <mhocko@kernel.org>
Cc: Vinayak Menon <vinmenon@codeaurora.org>,
	linux-mm@kvack.org, kernel-team@android.com
Subject: Re: [PATCH] mm: do not free shared swap slots
Date: Thu, 31 Oct 2019 07:46:08 -0700	[thread overview]
Message-ID: <20191031144608.GA128849@google.com> (raw)
In-Reply-To: <20191030102409.GZ31513@dhcp22.suse.cz>

On Wed, Oct 30, 2019 at 11:24:09AM +0100, Michal Hocko wrote:
> On Tue 29-10-19 17:24:47, Minchan Kim wrote:
> > On Tue, Oct 22, 2019 at 04:51:34PM +0530, Vinayak Menon wrote:
> > > The following race is observed due to which a processes faulting
> > > on a swap entry, finds the page neither in swapcache nor swap. This
> > > causes zram to give a zero filled page that gets mapped to the
> > > process, resulting in a user space crash later.
> > > 
> > > Consider parent and child processes Pa and Pb sharing the same swap
> > > slot with swap_count 2. Swap is on zram with SWP_SYNCHRONOUS_IO set.
> > > Virtual address 'VA' of Pa and Pb points to the shared swap entry.
> > > 
> > > Pa                                       Pb
> > > 
> > > fault on VA                              fault on VA
> > > do_swap_page                             do_swap_page
> > > lookup_swap_cache fails                  lookup_swap_cache fails
> > >                                          Pb scheduled out
> > > swapin_readahead (deletes zram entry)
> > > swap_free (makes swap_count 1)
> > >                                          Pb scheduled in
> > >                                          swap_readpage (swap_count == 1)
> > >                                          Takes SWP_SYNCHRONOUS_IO path
> > >                                          zram enrty absent
> > >                                          zram gives a zero filled page
> > > 
> > > Fix this by making sure that swap slot is freed only when swap count
> > > drops down to one.
> > > 
> > > Signed-off-by: Vinayak Menon <vinmenon@codeaurora.org>
> > > Suggested-by: Minchan Kim <minchan@google.com>
> > > Cc: Michal Hocko <mhocko@suse.com>
> > Acked-by: Minchan Kim <minchan@kernel.org>
> > 
> > -stable material from v4.15.
> 
> Which commit does this fix? Fixes: tag would be highly appreciated.

Oops, I missed to mention it.
Fixes: aa8d22a11da9 (mm: swap: SWP_SYNCHRONOUS_IO: skip swapcache only if swapped page has no other reference)

> 
> -- 
> Michal Hocko
> SUSE Labs


  reply	other threads:[~2019-10-31 14:46 UTC|newest]

Thread overview: 5+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-10-22 11:21 [PATCH] mm: do not free shared swap slots Vinayak Menon
2019-10-30  0:24 ` Minchan Kim
2019-10-30 10:24   ` Michal Hocko
2019-10-31 14:46     ` Minchan Kim [this message]
2019-10-31 17:15       ` Michal Hocko

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20191031144608.GA128849@google.com \
    --to=minchan@kernel.org \
    --cc=kernel-team@android.com \
    --cc=linux-mm@kvack.org \
    --cc=mhocko@kernel.org \
    --cc=vinmenon@codeaurora.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.