From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: From: Weijie Yang To: 'linux-kernel' , 'Linux-MM' Cc: 'Andrew Morton' , hughd@google.com, 'Minchan Kim' , shli@fusionio.com, 'Bob Liu' , k.kozlowski@samsung.com, stable@vger.kernel.org, weijie.yang.kh@gmail.com Subject: [PATCH] mm/swap: fix race on swap_info reuse between swapoff and swapon Date: Thu, 09 Jan 2014 13:39:55 +0800 Message-id: <000001cf0cfd$6d251640$476f42c0$%yang@samsung.com> MIME-version: 1.0 Content-type: text/plain; charset=UTF-8 Content-transfer-encoding: 7bit Content-language: zh-cn Sender: linux-kernel-owner@vger.kernel.org List-ID: swapoff clear swap_info's SWP_USED flag prematurely and free its resources after that. A concurrent swapon will reuse this swap_info while its previous resources are not cleared completely. These late freed resources are: - p->percpu_cluster - swap_cgroup_ctrl[type] - block_device setting - inode->i_flags &= ~S_SWAPFILE This patch clear SWP_USED flag after all its resources freed, so that swapon can reuse this swap_info by alloc_swap_info() safely. Signed-off-by: Weijie Yang --- mm/swapfile.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/mm/swapfile.c b/mm/swapfile.c index 612a7c9..89071c3 --- a/mm/swapfile.c +++ b/mm/swapfile.c @@ -1922,7 +1922,6 @@ SYSCALL_DEFINE1(swapoff, const char __user *, specialfile) p->swap_map = NULL; cluster_info = p->cluster_info; p->cluster_info = NULL; - p->flags = 0; frontswap_map = frontswap_map_get(p); spin_unlock(&p->lock); spin_unlock(&swap_lock); @@ -1948,6 +1947,16 @@ SYSCALL_DEFINE1(swapoff, const char __user *, specialfile) mutex_unlock(&inode->i_mutex); } filp_close(swap_file, NULL); + + /* + * clear SWP_USED flag after all resources freed + * so that swapon can reuse this swap_info in alloc_swap_info() safely + * it is ok to not hold p->lock after we cleared its SWP_WRITEOK + */ + spin_lock(&swap_lock); + p->flags = 0; + spin_unlock(&swap_lock); + err = 0; atomic_inc(&proc_poll_event); wake_up_interruptible(&proc_poll_wait); -- 1.7.10.4