From: Krzysztof Kozlowski <k.kozlowski@samsung.com>
To: Andrew Morton <akpm@linux-foundation.org>
Cc: linux-kernel@vger.kernel.org, linux-mm@kvack.org,
Weijie Yang <weijie.yang.kh@gmail.com>,
Bob Liu <bob.liu@oracle.com>,
Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>,
Shaohua Li <shli@fusionio.com>, Minchan Kim <minchan@kernel.org>
Subject: Re: [PATCH] swap: fix set_blocksize race during swapon/swapoff
Date: Mon, 14 Oct 2013 12:19:50 +0200 [thread overview]
Message-ID: <1381745990.24685.45.camel@AMDC1943> (raw)
In-Reply-To: <20131011115542.a81a9215d9b876706ec58a72@linux-foundation.org>
On Fri, 2013-10-11 at 11:55 -0700, Andrew Morton wrote:
> On Fri, 11 Oct 2013 11:54:22 +0200 Krzysztof Kozlowski <k.kozlowski@samsung.com> wrote:
>
> > Swapoff used old_block_size from swap_info which could be overwritten by
> > concurrent swapon.
>
> Better changelogs, please. What were the user-visible effects of the
> bug, and how is it triggered?
Let me update a little the changelog:
--------
Fix race between swapoff and swapon. Swapoff used old_block_size from
swap_info outside of swapon_mutex so it could be overwritten by
concurrent swapon.
The race has visible effect only if more than one swap block device
exists with different block sizes (e.g. /dev/sda1 with block size 4096
and /dev/sdb1 with 512). In such case it leads to setting the blocksize
of swapped off device with wrong blocksize.
The bug can be triggered with multiple concurrent swapoff and swapon:
0. Swap for some device is on.
1. swapoff:
First the swapoff is called on this device and "struct swap_info_struct
*p" is assigned. This is done under swap_lock however this lock is
released for the call try_to_unuse().
2. swapon:
After the assignment above (and before acquiring swapon_mutex &
swap_lock by swapoff) the swapon is called on the same device.
The p->old_block_size is assigned to the value of block_size the device.
This block size should be the same as previous but sometimes it is not.
The swapon ends successfully.
3. swapoff:
Swapoff resumes, grabs the locks and mutex and continues to disable this
swap device. Now it sets the block size to value taken from swap_info
which was overwritten by swapon in 2.
--------
Best regards,
Krzysztof
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>
WARNING: multiple messages have this Message-ID (diff)
From: Krzysztof Kozlowski <k.kozlowski@samsung.com>
To: Andrew Morton <akpm@linux-foundation.org>
Cc: linux-kernel@vger.kernel.org, linux-mm@kvack.org,
Weijie Yang <weijie.yang.kh@gmail.com>,
Bob Liu <bob.liu@oracle.com>,
Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>,
Shaohua Li <shli@fusionio.com>, Minchan Kim <minchan@kernel.org>
Subject: Re: [PATCH] swap: fix set_blocksize race during swapon/swapoff
Date: Mon, 14 Oct 2013 12:19:50 +0200 [thread overview]
Message-ID: <1381745990.24685.45.camel@AMDC1943> (raw)
In-Reply-To: <20131011115542.a81a9215d9b876706ec58a72@linux-foundation.org>
On Fri, 2013-10-11 at 11:55 -0700, Andrew Morton wrote:
> On Fri, 11 Oct 2013 11:54:22 +0200 Krzysztof Kozlowski <k.kozlowski@samsung.com> wrote:
>
> > Swapoff used old_block_size from swap_info which could be overwritten by
> > concurrent swapon.
>
> Better changelogs, please. What were the user-visible effects of the
> bug, and how is it triggered?
Let me update a little the changelog:
--------
Fix race between swapoff and swapon. Swapoff used old_block_size from
swap_info outside of swapon_mutex so it could be overwritten by
concurrent swapon.
The race has visible effect only if more than one swap block device
exists with different block sizes (e.g. /dev/sda1 with block size 4096
and /dev/sdb1 with 512). In such case it leads to setting the blocksize
of swapped off device with wrong blocksize.
The bug can be triggered with multiple concurrent swapoff and swapon:
0. Swap for some device is on.
1. swapoff:
First the swapoff is called on this device and "struct swap_info_struct
*p" is assigned. This is done under swap_lock however this lock is
released for the call try_to_unuse().
2. swapon:
After the assignment above (and before acquiring swapon_mutex &
swap_lock by swapoff) the swapon is called on the same device.
The p->old_block_size is assigned to the value of block_size the device.
This block size should be the same as previous but sometimes it is not.
The swapon ends successfully.
3. swapoff:
Swapoff resumes, grabs the locks and mutex and continues to disable this
swap device. Now it sets the block size to value taken from swap_info
which was overwritten by swapon in 2.
--------
Best regards,
Krzysztof
next prev parent reply other threads:[~2013-10-14 10:21 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-10-11 9:54 [PATCH] swap: fix set_blocksize race during swapon/swapoff Krzysztof Kozlowski
2013-10-11 9:54 ` Krzysztof Kozlowski
2013-10-11 18:55 ` Andrew Morton
2013-10-11 18:55 ` Andrew Morton
2013-10-14 10:19 ` Krzysztof Kozlowski [this message]
2013-10-14 10:19 ` Krzysztof Kozlowski
2013-10-11 19:02 ` Andrew Morton
2013-10-11 19:02 ` Andrew Morton
2013-10-14 9:47 ` Krzysztof Kozlowski
2013-10-14 9:47 ` Krzysztof Kozlowski
2013-10-15 9:56 ` Hugh Dickins
2013-10-15 9:56 ` Hugh Dickins
2013-10-15 9:45 ` Hugh Dickins
2013-10-15 9:45 ` Hugh Dickins
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1381745990.24685.45.camel@AMDC1943 \
--to=k.kozlowski@samsung.com \
--cc=akpm@linux-foundation.org \
--cc=bob.liu@oracle.com \
--cc=konrad.wilk@oracle.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=minchan@kernel.org \
--cc=shli@fusionio.com \
--cc=weijie.yang.kh@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.