From: Marcelo Tosatti <marcelo@conectiva.com.br>
To: Hugh Dickins <hugh@veritas.com>
Cc: Linus Torvalds <torvalds@transmeta.com>,
Rik van Riel <riel@conectiva.com.br>,
lkml <linux-kernel@vger.kernel.org>
Subject: Re: 2.4.10pre VM changes: Potential race condition on swap code
Date: Thu, 13 Sep 2001 17:36:25 -0300 (BRT) [thread overview]
Message-ID: <Pine.LNX.4.21.0109131736050.4107-100000@freak.distro.conectiva> (raw)
In-Reply-To: <Pine.LNX.4.21.0109131718320.4107-100000@freak.distro.conectiva>
On Thu, 13 Sep 2001, Marcelo Tosatti wrote:
>
>
> On Thu, 13 Sep 2001, Marcelo Tosatti wrote:
>
> >
> >
> > On Thu, 13 Sep 2001, Hugh Dickins wrote:
> >
> > > On Wed, 12 Sep 2001, Marcelo Tosatti wrote:
> > > > On Tue, 11 Sep 2001, Hugh Dickins wrote:
> > > > > It may be made more likely by my swapoff changes (not bumping swap
> > > > > count in valid_swaphandles), but it's not been introduced by those
> > > > > changes. Though usually swapin_readahead/valid_swaphandles covers
> > > > > (includes) the particular swap entry which do_swap_page actually
> > > > > wants to bring in, under pressure that's not always so, and then
> > > > > the race you outline can occur with the "bare" read_swap_cache_async
> > > > > for which there was no bumping. Furthermore, you can play your
> > > > > scenario with valid_swaphandles through to add_to_swap_cache on CPU0
> > > > > interposed between the get_swap_page and add_to_swap_cache on CPU1
> > > > > (if interrupt on CPU1 diverts it).
> > > >
> > > > I don't think so. A "bare" read_swap_cache_async() call only happens on
> > > > swap entries which already have additional references. That is, its
> > > > guaranteed that a "bare" read_swap_cache_async() call only happens for
> > > > swap map entries which already have a reference, so we're guaranteed that
> > > > it cannot be reused.
> > >
> > > Almost agreed, but there may be a long interval between when that reference
> > > was observed in the page table, and when read_swap_cache_async upon it is
> > > actually performed (waiting for BKL, waiting to allocate pages for prior
> > > swapin_readahead). In that interval the reference can be removed:
> > > certainly by swapoff, certainly by vm_swap_full removal, anything else?
> >
> > Not sure about swapoff().
> >
> > vm_swap_full() is only going to remove the reference _after_ we did the
> > swapin, so I don't see how the race can happen with it.
>
> Ooh I see:
>
> CPU0 CPU1 CPU2
> do_swap_page() try_to_swap_out() swapin_readahead()
> swapin_readahead() finds valid swap
> map entry and considers it "readable"
>
> swap_free(entry);
> get_swap_page()
>
> if (exclusive_swap_p..) {
> if (vm_swap_full()) {
> delete_from_swap_cache_nolock(page);
> pte = pte_mkdirty(pte);
> }
> }
> UnlockPage(page);
>
> __find_get_page() fails on swapin_readahead()
> swap_duplicate() succeeds.
> add_to_swap_cache()
> add_to_swap_cache()
>
> BOOM.
>
> Now, if we get additional references at valid_swaphandles() the above race
> is NOT possible: we're guaranteed that any get_swap_page() will not find
Err I mean _will_ find the swap map entry used and not use it, then.
> the swap map entry used. See?
next prev parent reply other threads:[~2001-09-13 22:01 UTC|newest]
Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top
2001-09-11 22:40 2.4.10pre VM changes: Potential race condition on swap code Marcelo Tosatti
2001-09-11 0:14 ` Hugh Dickins
2001-09-13 1:35 ` Marcelo Tosatti
2001-09-13 7:15 ` Hugh Dickins
2001-09-13 19:34 ` Marcelo Tosatti
2001-09-13 20:31 ` Marcelo Tosatti
2001-09-13 20:36 ` Marcelo Tosatti [this message]
2001-09-13 22:04 ` Marcelo Tosatti
2001-09-13 22:29 ` Marcelo Tosatti
2001-09-14 13:14 ` Hugh Dickins
2001-09-14 11:45 ` Hugh Dickins
2001-09-14 18:05 ` Marcelo Tosatti
2001-09-14 19:44 ` Marcelo Tosatti
2001-09-14 21:55 ` Hugh Dickins
2001-09-14 21:10 ` Marcelo Tosatti
2001-09-15 0:12 ` Hugh Dickins
2001-09-15 6:29 ` Hugh Dickins
2001-09-15 11:39 ` [PATCH] Re: 2.4.10pre VM changes: Potential race Hugh Dickins
2001-09-17 18:49 ` Marcelo Tosatti
2001-09-18 4:00 ` Marcelo Tosatti
2001-09-22 9:19 ` 2.4.10pre VM changes: Potential race condition on swap code Andrea Arcangeli
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=Pine.LNX.4.21.0109131736050.4107-100000@freak.distro.conectiva \
--to=marcelo@conectiva.com.br \
--cc=hugh@veritas.com \
--cc=linux-kernel@vger.kernel.org \
--cc=riel@conectiva.com.br \
--cc=torvalds@transmeta.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).