From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 760DDC432C0 for ; Tue, 19 Nov 2019 06:12:10 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 4882D20692 for ; Tue, 19 Nov 2019 06:12:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1574143930; bh=Rif4rUzkg3AEi75QZe60tBKQXzf7Rk87RG+4EJ8tiU4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=oUIowDhmq0IsGg2nIk9UFPvEpGIDFQa9RwqUBgk2jmIZ2S80XhpCKXIqIRMwcemWC 2GbO7tX+UnblAKvanrX0NDKsZfRL3ST4WMC4l4NBCcte2Kwn7gTwIXvypAwXSo/0ZN JgpWtOe5yucO1e/63VSgDYM9vqc3qr1ngLkrv8Hk= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726905AbfKSFXI (ORCPT ); Tue, 19 Nov 2019 00:23:08 -0500 Received: from mail.kernel.org ([198.145.29.99]:38658 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727919AbfKSFXI (ORCPT ); Tue, 19 Nov 2019 00:23:08 -0500 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 55C4D2231C; Tue, 19 Nov 2019 05:23:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1574140986; bh=Rif4rUzkg3AEi75QZe60tBKQXzf7Rk87RG+4EJ8tiU4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=OZ3vO6VJ5gL3ICYB6bhuizq4F7fTopQXrx7iwCYMshOhb+qiGUpqfDpt5PDmh+ELp MudfcTAL4wEiYnoqaiTKmZSenYeG0nOOQZrq6fGQS/L5ve97Zz4sT/1gyu77PG+bxB w/OwC9Mi9/2dDI7AZSvttZKcTyVJPvaQsyKXqmzQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Vinayak Menon , Minchan Kim , Minchan Kim , Michal Hocko , Hugh Dickins , Andrew Morton , Linus Torvalds Subject: [PATCH 5.3 47/48] mm/page_io.c: do not free shared swap slots Date: Tue, 19 Nov 2019 06:20:07 +0100 Message-Id: <20191119051030.408461659@linuxfoundation.org> X-Mailer: git-send-email 2.24.0 In-Reply-To: <20191119050946.745015350@linuxfoundation.org> References: <20191119050946.745015350@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Vinayak Menon commit 5df373e95689b9519b8557da7c5bd0db0856d776 upstream. The following race is observed due to which a processes faulting on a swap entry, finds the page neither in swapcache nor swap. This causes zram to give a zero filled page that gets mapped to the process, resulting in a user space crash later. Consider parent and child processes Pa and Pb sharing the same swap slot with swap_count 2. Swap is on zram with SWP_SYNCHRONOUS_IO set. Virtual address 'VA' of Pa and Pb points to the shared swap entry. Pa Pb fault on VA fault on VA do_swap_page do_swap_page lookup_swap_cache fails lookup_swap_cache fails Pb scheduled out swapin_readahead (deletes zram entry) swap_free (makes swap_count 1) Pb scheduled in swap_readpage (swap_count == 1) Takes SWP_SYNCHRONOUS_IO path zram enrty absent zram gives a zero filled page Fix this by making sure that swap slot is freed only when swap count drops down to one. Link: http://lkml.kernel.org/r/1571743294-14285-1-git-send-email-vinmenon@codeaurora.org Fixes: aa8d22a11da9 ("mm: swap: SWP_SYNCHRONOUS_IO: skip swapcache only if swapped page has no other reference") Signed-off-by: Vinayak Menon Suggested-by: Minchan Kim Acked-by: Minchan Kim Cc: Michal Hocko Cc: Hugh Dickins Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman --- mm/page_io.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) --- a/mm/page_io.c +++ b/mm/page_io.c @@ -73,6 +73,7 @@ static void swap_slot_free_notify(struct { struct swap_info_struct *sis; struct gendisk *disk; + swp_entry_t entry; /* * There is no guarantee that the page is in swap cache - the software @@ -104,11 +105,10 @@ static void swap_slot_free_notify(struct * we again wish to reclaim it. */ disk = sis->bdev->bd_disk; - if (disk->fops->swap_slot_free_notify) { - swp_entry_t entry; + entry.val = page_private(page); + if (disk->fops->swap_slot_free_notify && __swap_count(entry) == 1) { unsigned long offset; - entry.val = page_private(page); offset = swp_offset(entry); SetPageDirty(page);