From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-3.8 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2B39EC4346E for ; Thu, 24 Sep 2020 06:57:27 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id A5DA6235F7 for ; Thu, 24 Sep 2020 06:57:26 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org A5DA6235F7 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=intel.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 16B27900007; Thu, 24 Sep 2020 02:57:26 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 11B05900004; Thu, 24 Sep 2020 02:57:26 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id F258C900007; Thu, 24 Sep 2020 02:57:25 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0252.hostedemail.com [216.40.44.252]) by kanga.kvack.org (Postfix) with ESMTP id DAA59900004 for ; Thu, 24 Sep 2020 02:57:25 -0400 (EDT) Received: from smtpin28.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay01.hostedemail.com (Postfix) with ESMTP id AA2F5180AD804 for ; Thu, 24 Sep 2020 06:57:25 +0000 (UTC) X-FDA: 77297048850.28.rate29_27002f12715d Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin28.hostedemail.com (Postfix) with ESMTP id 850316C04 for ; Thu, 24 Sep 2020 06:57:25 +0000 (UTC) X-HE-Tag: rate29_27002f12715d X-Filterd-Recvd-Size: 3315 Received: from mga14.intel.com (mga14.intel.com [192.55.52.115]) by imf10.hostedemail.com (Postfix) with ESMTP for ; Thu, 24 Sep 2020 06:57:23 +0000 (UTC) IronPort-SDR: i2mCi0zTwFbLkDtbEWQ2iyN68GtV7Xfeuuf8s0ut+7tRK2iCYrJudGYznhQctlGJM8ptHpg+/L AypRAO581eOQ== X-IronPort-AV: E=McAfee;i="6000,8403,9753"; a="160409262" X-IronPort-AV: E=Sophos;i="5.77,296,1596524400"; d="scan'208";a="160409262" X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga008.jf.intel.com ([10.7.209.65]) by fmsmga103.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 23 Sep 2020 23:57:22 -0700 IronPort-SDR: TtuPRGHSrFfPT77WvdNkzCxkOuBtHHh8rPRBoT2X/iSXQsRe6KpFaKORl9wqrWlnho3kF0tT9q yn1f6l3PoCBA== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.77,296,1596524400"; d="scan'208";a="338944949" Received: from unknown (HELO yhuang-dev) ([10.239.159.65]) by orsmga008.jf.intel.com with ESMTP; 23 Sep 2020 23:57:20 -0700 From: "Huang\, Ying" To: Rafael Aquini Cc: linux-mm@kvack.org, linux-kernel@vger.kernel.org, akpm@linux-foundation.org Subject: Re: [PATCH] mm: swapfile: avoid split_swap_cluster() NULL pointer dereference References: <20200922184838.978540-1-aquini@redhat.com> <878sd1qllb.fsf@yhuang-dev.intel.com> <20200923043459.GL795820@optiplex-lnx> <87sgb9oz1u.fsf@yhuang-dev.intel.com> <20200923130138.GM795820@optiplex-lnx> <87blhwng5f.fsf@yhuang-dev.intel.com> <20200924020928.GC1023012@optiplex-lnx> <877dsjessq.fsf@yhuang-dev.intel.com> <20200924063038.GD1023012@optiplex-lnx> Date: Thu, 24 Sep 2020 14:57:20 +0800 In-Reply-To: <20200924063038.GD1023012@optiplex-lnx> (Rafael Aquini's message of "Thu, 24 Sep 2020 02:30:38 -0400") Message-ID: <87y2kzd5m7.fsf@yhuang-dev.intel.com> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/26.3 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=ascii X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: Rafael Aquini writes: >> >> If there's a race, we should fix the race. But the code path for >> swapcache insertion is, >> >> add_to_swap() >> get_swap_page() /* Return if fails to allocate */ >> add_to_swap_cache() >> SetPageSwapCache() >> >> While the code path to split THP is, >> >> split_huge_page_to_list() >> if PageSwapCache() >> split_swap_cluster() >> >> Both code paths are protected by the page lock. So there should be some >> other reasons to trigger the bug. > > As mentioned above, no they seem to not be protected (at least, not the > same page, depending on the case). While add_to_swap() will assure a > page_lock on the compound head, split_huge_page_to_list() does not. > int split_huge_page_to_list(struct page *page, struct list_head *list) { struct page *head = compound_head(page); struct pglist_data *pgdata = NODE_DATA(page_to_nid(head)); struct deferred_split *ds_queue = get_deferred_split_queue(head); struct anon_vma *anon_vma = NULL; struct address_space *mapping = NULL; int count, mapcount, extra_pins, ret; unsigned long flags; pgoff_t end; VM_BUG_ON_PAGE(is_huge_zero_page(head), head); VM_BUG_ON_PAGE(!PageLocked(head), head); I found there's page lock checking in split_huge_page_to_list(). Best Regards, Huang, Ying