From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 66BE0C432C0 for ; Mon, 18 Nov 2019 16:37:25 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 31EB021852 for ; Mon, 18 Nov 2019 16:37:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1574095045; bh=SWIrsqLVJPdRxx8Zl0YlHvZm3DPqurCUiKR1A+AbXv8=; h=Subject:To:Cc:From:Date:List-ID:From; b=T2SpcPeyMs4SN7ScUEzpIiXXgaI7Ik8sPObyHxsWbCvNgGptlbduqIKjlic9d1WKD 5An3eFmILv4zMBGZjQ82k96H1vtOjleyKbYIlM5x3wNzEQn/rzakVbIquVmc4umUYf 3FzHXiVNWLhChzN3VVq2SQO8QxekBcm9VJplgwkc= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726635AbfKRQhY (ORCPT ); Mon, 18 Nov 2019 11:37:24 -0500 Received: from wout5-smtp.messagingengine.com ([64.147.123.21]:52167 "EHLO wout5-smtp.messagingengine.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726475AbfKRQhY (ORCPT ); Mon, 18 Nov 2019 11:37:24 -0500 Received: from compute6.internal (compute6.nyi.internal [10.202.2.46]) by mailout.west.internal (Postfix) with ESMTP id C019A6AB; Mon, 18 Nov 2019 11:37:22 -0500 (EST) Received: from mailfrontend2 ([10.202.2.163]) by compute6.internal (MEProxy); Mon, 18 Nov 2019 11:37:23 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:content-transfer-encoding:content-type :date:from:message-id:mime-version:subject:to:x-me-proxy :x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm1; bh=82XT/G vxKb2yfizXyIXfcrk+LrbY1rQkX7src4u8O0g=; b=J4NiiUwztakzSdUaprUM/L er1xnHFKZ3PG7Ottxuu+TifOnKA4VjK8h9FQwFmIJhr3UOE/OeyyCw6S5aPoKLO/ yvR/c+nxENQELz1JaOPvTUtHDqRlUlElB0W+BIrWL5QlsJ98fdnJGqBwT4pCbHI6 FjlgHimX7qUQlR9qq13qsh629GAGk/y1uxpvaVocTJoZYuMStLvtoEjNsZL8/aFM aMY0VeiFgk1UHUSCJrwLkoMRKokLU6Yd8s/5ZOHhCLbwCLG0sDObjMK/4Z/pgJF5 B+4HUu4hcR33u6RTjsceWDA9oNZLZ/4HMuwtb+g+vrychiKw0Zxf++gQeNjuvgYA == X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedufedrudegiedgieelucetufdoteggodetrfdotf fvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdfqfgfvpdfurfetoffkrfgpnffqhgen uceurghilhhouhhtmecufedttdenucenucfjughrpefuvffhfffkgggtgfesthekredttd dtlfenucfhrhhomhepoehgrhgvghhkhheslhhinhhugihfohhunhgurghtihhonhdrohhr gheqnecuffhomhgrihhnpehkvghrnhgvlhdrohhrghenucfkphepkeefrdekiedrkeelrd dutdejnecurfgrrhgrmhepmhgrihhlfhhrohhmpehgrhgvgheskhhrohgrhhdrtghomhen ucevlhhushhtvghrufhiiigvpedt X-ME-Proxy: Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) by mail.messagingengine.com (Postfix) with ESMTPA id CC29A3060064; Mon, 18 Nov 2019 11:37:21 -0500 (EST) Subject: FAILED: patch "[PATCH] mm/page_io.c: do not free shared swap slots" failed to apply to 4.19-stable tree To: vinmenon@codeaurora.org, akpm@linux-foundation.org, hughd@google.com, mhocko@suse.com, minchan@google.com, minchan@kernel.org, stable@vger.kernel.org, torvalds@linux-foundation.org Cc: From: Date: Mon, 18 Nov 2019 17:37:16 +0100 Message-ID: <1574095036140231@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org The patch below does not apply to the 4.19-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to . thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From 5df373e95689b9519b8557da7c5bd0db0856d776 Mon Sep 17 00:00:00 2001 From: Vinayak Menon Date: Fri, 15 Nov 2019 17:35:00 -0800 Subject: [PATCH] mm/page_io.c: do not free shared swap slots The following race is observed due to which a processes faulting on a swap entry, finds the page neither in swapcache nor swap. This causes zram to give a zero filled page that gets mapped to the process, resulting in a user space crash later. Consider parent and child processes Pa and Pb sharing the same swap slot with swap_count 2. Swap is on zram with SWP_SYNCHRONOUS_IO set. Virtual address 'VA' of Pa and Pb points to the shared swap entry. Pa Pb fault on VA fault on VA do_swap_page do_swap_page lookup_swap_cache fails lookup_swap_cache fails Pb scheduled out swapin_readahead (deletes zram entry) swap_free (makes swap_count 1) Pb scheduled in swap_readpage (swap_count == 1) Takes SWP_SYNCHRONOUS_IO path zram enrty absent zram gives a zero filled page Fix this by making sure that swap slot is freed only when swap count drops down to one. Link: http://lkml.kernel.org/r/1571743294-14285-1-git-send-email-vinmenon@codeaurora.org Fixes: aa8d22a11da9 ("mm: swap: SWP_SYNCHRONOUS_IO: skip swapcache only if swapped page has no other reference") Signed-off-by: Vinayak Menon Suggested-by: Minchan Kim Acked-by: Minchan Kim Cc: Michal Hocko Cc: Hugh Dickins Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds diff --git a/mm/page_io.c b/mm/page_io.c index 24ee600f9131..60a66a58b9bf 100644 --- a/mm/page_io.c +++ b/mm/page_io.c @@ -73,6 +73,7 @@ static void swap_slot_free_notify(struct page *page) { struct swap_info_struct *sis; struct gendisk *disk; + swp_entry_t entry; /* * There is no guarantee that the page is in swap cache - the software @@ -104,11 +105,10 @@ static void swap_slot_free_notify(struct page *page) * we again wish to reclaim it. */ disk = sis->bdev->bd_disk; - if (disk->fops->swap_slot_free_notify) { - swp_entry_t entry; + entry.val = page_private(page); + if (disk->fops->swap_slot_free_notify && __swap_count(entry) == 1) { unsigned long offset; - entry.val = page_private(page); offset = swp_offset(entry); SetPageDirty(page);