Re: [merged mm-hotfixes-stable] zsmalloc-fix-a-race-with-deferred_handles-storing.patch removed from -mm tree

[Sergey Senozhatsky <senozhatsky@chromium.org>]

On (23/01/31 16:44), Andrew Morton wrote:
> Currently, there is a race between zs_free() and zs_reclaim_page():
> zs_reclaim_page() finds a handle to an allocated object, but before the
> eviction happens, an independent zs_free() call to the same handle could
> come in and overwrite the object value stored at the handle with the last
> deferred handle.  When zs_reclaim_page() finally gets to call the eviction
> handler, it will see an invalid object value (i.e the previous deferred
> handle instead of the original object value).
> 
> This race happens quite infrequently.  We only managed to produce it with
> out-of-tree developmental code that triggers zsmalloc writeback with a
> much higher frequency than usual.
> 
> This patch fixes this race by storing the deferred handle in the object
> header instead.  We differentiate the deferred handle from the other two
> cases (handle for allocated object, and linkage for free object) with a
> new tag.  If zspage reclamation succeeds, we will free these deferred
> handles by walking through the zspage objects.  On the other hand, if
> zspage reclamation fails, we reconstruct the zspage freelist (with the
> deferred handle tag and allocated tag) before trying again with the
> reclamation.
> 
> [arnd@arndb.de: avoid unused-function warning]
>   Link: https://lkml.kernel.org/r/20230117170507.2651972-1-arnd@kernel.org
> Link: https://lkml.kernel.org/r/20230110231701.326724-1-nphamcs@gmail.com
> Fixes: 9997bc017549 ("zsmalloc: implement writeback mechanism for zsmalloc")
> Signed-off-by: Nhat Pham <nphamcs@gmail.com>
> Signed-off-by: Arnd Bergmann <arnd@arndb.de>
> Suggested-by: Johannes Weiner <hannes@cmpxchg.org>
> Cc: Dan Streetman <ddstreet@ieee.org>
> Cc: Minchan Kim <minchan@kernel.org>
> Cc: Nitin Gupta <ngupta@vflare.org>
> Cc: Sergey Senozhatsky <senozhatsky@chromium.org>
> Cc: Seth Jennings <sjenning@redhat.com>
> Cc: Vitaly Wool <vitaly.wool@konsulko.com>
> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>

Reviewed-by: Sergey Senozhatsky <senozhatsky@chromium.org>