[PATCH V3 0/2] mm: fix race condition in MADV_FREE

[Shaohua Li <shli@kernel.org>]

From: Shaohua Li <shli@fb.com>

Artem Savkov reported a race condition[1] in MADV_FREE. MADV_FREE clear pte
dirty bit and then mark the page lazyfree. There is no lock to prevent the
page is added to swap cache between these two steps by page reclaim. There are
two problems:
- page in swapcache is marked lazyfree (clear SwapBacked). This confuses some
  code pathes, like page fault handling.
- The page is added into swapcache, and freed but the page isn't swapout
  because pte isn't dirty. This will cause data corruption.

The patches will fix the issues.

I knew Minchan suggested these should be combined to one patch, but I really
think the separation makes things clearer because these are two issues even
they are stemmed from the same race.

Thanks,
Shaohua

V2->V3:
- reword patch log and code comments, no code change

V1->V2:
- dirty page in add_to_swap instead of in shrink_page_list as suggested by Minchan

Shaohua Li (2):
  mm: avoid marking swap cached page as lazyfree
  mm: fix data corruption caused by lazyfree page

 mm/swap.c       |  4 ++--
 mm/swap_state.c | 11 +++++++++++
 2 files changed, 13 insertions(+), 2 deletions(-)

-- 
2.9.5

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>