Stable Archive on
 help / color / Atom feed
* + mm-do-not-free-shared-swap-slots.patch added to -mm tree
@ 2019-11-09  1:55 akpm
  0 siblings, 0 replies; only message in thread
From: akpm @ 2019-11-09  1:55 UTC (permalink / raw)
  To: hughd, mhocko, minchan, minchan, mm-commits, stable, vinmenon

The patch titled
     Subject: mm/page_io.c: do not free shared swap slots
has been added to the -mm tree.  Its filename is

This patch should soon appear at
and later at

Before you just go and hit "reply", please:
   a) Consider who else should be cc'ed
   b) Prefer to cc a suitable mailing list as well
   c) Ideally: find the original patch on the mailing list and do a
      reply-to-all to that, adding suitable additional cc's

*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***

The -mm tree is included into linux-next and is updated
there every 3-4 working days

From: Vinayak Menon <>
Subject: mm/page_io.c: do not free shared swap slots

The following race is observed due to which a processes faulting on a swap
entry, finds the page neither in swapcache nor swap.  This causes zram to
give a zero filled page that gets mapped to the process, resulting in a
user space crash later.

Consider parent and child processes Pa and Pb sharing the same swap slot
with swap_count 2.  Swap is on zram with SWP_SYNCHRONOUS_IO set.  Virtual
address 'VA' of Pa and Pb points to the shared swap entry.

Pa                                       Pb

fault on VA                              fault on VA
do_swap_page                             do_swap_page
lookup_swap_cache fails                  lookup_swap_cache fails
                                         Pb scheduled out
swapin_readahead (deletes zram entry)
swap_free (makes swap_count 1)
                                         Pb scheduled in
                                         swap_readpage (swap_count == 1)
                                         Takes SWP_SYNCHRONOUS_IO path
                                         zram enrty absent
                                         zram gives a zero filled page

Fix this by making sure that swap slot is freed only when swap count drops
down to one.

Fixes: aa8d22a11da9 ("mm: swap: SWP_SYNCHRONOUS_IO: skip swapcache only if swapped page has no other reference")
Signed-off-by: Vinayak Menon <>
Suggested-by: Minchan Kim <>
Acked-by: Minchan Kim <>
Cc: Michal Hocko <>
Cc: Hugh Dickins <>
Cc: <>
Signed-off-by: Andrew Morton <>

 mm/page_io.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- a/mm/page_io.c~mm-do-not-free-shared-swap-slots
+++ a/mm/page_io.c
@@ -73,6 +73,7 @@ static void swap_slot_free_notify(struct
 	struct swap_info_struct *sis;
 	struct gendisk *disk;
+	swp_entry_t entry;
 	 * There is no guarantee that the page is in swap cache - the software
@@ -104,11 +105,10 @@ static void swap_slot_free_notify(struct
 	 * we again wish to reclaim it.
 	disk = sis->bdev->bd_disk;
-	if (disk->fops->swap_slot_free_notify) {
-		swp_entry_t entry;
+	entry.val = page_private(page);
+	if (disk->fops->swap_slot_free_notify && __swap_count(entry) == 1) {
 		unsigned long offset;
-		entry.val = page_private(page);
 		offset = swp_offset(entry);

Patches currently in -mm which might be from are


^ permalink raw reply	[flat|nested] only message in thread

only message in thread, back to index

Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-11-09  1:55 + mm-do-not-free-shared-swap-slots.patch added to -mm tree akpm

Stable Archive on

Archives are clonable:
	git clone --mirror stable/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 stable stable/ \
	public-inbox-index stable

Example config snippet for mirrors

Newsgroup available over NNTP:

AGPL code for this site: git clone