FAILED: patch "[PATCH] mm/page_io.c: do not free shared swap slots" failed to apply to 4.19-stable tree

PATCH [email protected] 3 participants 5 messages Nov 18, 2019 – Nov 25, 2019

Subsystems (3)

Stable branch Memory management MM swap

lore

Share & tools

lore

[email protected]

author maintainer

2019-11-18 16:37 UTC #0 lore raw

The patch below does not apply to the 4.19-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From 5df373e95689b9519b8557da7c5bd0db0856d776 Mon Sep 17 00:00:00 2001
From: Vinayak Menon <[email protected]>
Date: Fri, 15 Nov 2019 17:35:00 -0800
Subject: [PATCH] mm/page_io.c: do not free shared swap slots

The following race is observed due to which a processes faulting on a swap entry, finds the page neither in swapcache nor swap. This causes zram to give a zero filled page that gets mapped to the process, resulting in a user space crash later.

Consider parent and child processes Pa and Pb sharing the same swap slot with swap_count 2. Swap is on zram with SWP_SYNCHRONOUS_IO set. Virtual address 'VA' of Pa and Pb points to the shared swap entry.

Pa Pb

fault on VA                              fault on VA
do_swap_page                             do_swap_page
lookup_swap_cache fails                  lookup_swap_cache fails

Pb scheduled out
swapin_readahead (deletes zram entry)
swap_free (makes swap_count 1)
Pb scheduled in swap_readpage (swap_count == 1) Takes SWP_SYNCHRONOUS_IO path zram enrty absent zram gives a zero filled page

Fix this by making sure that swap slot is freed only when swap count drops down to one.

Link http://lkml.kernel.org/r/[email protected] open here

Fixes aa8d22a11da9 ("mm: swap: SWP_SYNCHRONOUS_IO: skip swapcache only if swapped page has no other reference")

Signed-off-by Vinayak Menon <[email protected]>

Acked-by Minchan Kim <[email protected]>

Cc Michal Hocko <[email protected]>

Cc Hugh Dickins <[email protected]>

Cc <[email protected]>

Signed-off-by Andrew Morton <[email protected]>

Signed-off-by Linus Torvalds <[email protected]>

mm/page_io.c +3 -3

index 24ee600f9131..60a66a58b9bf 100644
@@ -73,6 +73,7 @@ static void swap_slot_free_notify(struct page *page)
 {
 	struct swap_info_struct *sis;
 	struct gendisk *disk;
+	swp_entry_t entry;
 
 	/*
 	 * There is no guarantee that the page is in swap cache - the software

@@ -104,11 +105,10 @@ static void swap_slot_free_notify(struct page *page)
 	 * we again wish to reclaim it.
 	 */
 	disk = sis->bdev->bd_disk;
-	if (disk->fops->swap_slot_free_notify) {
-		swp_entry_t entry;
+	entry.val = page_private(page);
+	if (disk->fops->swap_slot_free_notify && __swap_count(entry) == 1) {
 		unsigned long offset;
 
-		entry.val = page_private(page);
 		offset = swp_offset(entry);
 
 		SetPageDirty(page);

Greg KH

author maintainer

2019-11-18 16:40 UTC #1 lore raw

Quoted 5 lines · On Mon, Nov 18, 2019 at 05:37:16PM +0100, [email protected] wrote:

The patch below does not apply to the 4.19-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.

Note, this applies, but just breaks the build, so it needs a backport for 4.19 if people want to see it there.

thanks,

greg k-h

Quoted 71 lines

------------------ original commit in Linus's tree ------------------
Quoted 1 line
From 5df373e95689b9519b8557da7c5bd0db0856d776 Mon Sep 17 00:00:00 2001
From: Vinayak Menon <[email protected]>
Date: Fri, 15 Nov 2019 17:35:00 -0800
Subject: [PATCH] mm/page_io.c: do not free shared swap slots
The following race is observed due to which a processes faulting on a swap entry, finds the page neither in swapcache nor swap. This causes zram to give a zero filled page that gets mapped to the process, resulting in a user space crash later.
Consider parent and child processes Pa and Pb sharing the same swap slot with swap_count 2. Swap is on zram with SWP_SYNCHRONOUS_IO set. Virtual address 'VA' of Pa and Pb points to the shared swap entry.
Pa Pb
fault on VA                              fault on VA
do_swap_page                             do_swap_page
lookup_swap_cache fails                  lookup_swap_cache fails
Pb scheduled out
swapin_readahead (deletes zram entry)
swap_free (makes swap_count 1)
Pb scheduled in swap_readpage (swap_count == 1) Takes SWP_SYNCHRONOUS_IO path zram enrty absent zram gives a zero filled page
Fix this by making sure that swap slot is freed only when swap count drops down to one.
Link http://lkml.kernel.org/r/[email protected] open here
Fixes aa8d22a11da9 ("mm: swap: SWP_SYNCHRONOUS_IO: skip swapcache only if swapped page has no other reference")
Signed-off-by Vinayak Menon <[email protected]>
Suggested-by Minchan Kim <[email protected]>
Acked-by Minchan Kim <[email protected]>
Cc Michal Hocko <[email protected]>
Cc Hugh Dickins <[email protected]>
Cc <[email protected]>
Signed-off-by Andrew Morton <[email protected]>
Signed-off-by Linus Torvalds <[email protected]>
mm/page_io.c +3 -3
index 24ee600f9131..60a66a58b9bf 100644
@@ -73,6 +73,7 @@ static void swap_slot_free_notify(struct page *page)
 {
 	struct swap_info_struct *sis;
 	struct gendisk *disk;
+	swp_entry_t entry;
 
 	/*
 	 * There is no guarantee that the page is in swap cache - the software
@@ -104,11 +105,10 @@ static void swap_slot_free_notify(struct page *page)
 	 * we again wish to reclaim it.
 	 */
 	disk = sis->bdev->bd_disk;
-	if (disk->fops->swap_slot_free_notify) {
-		swp_entry_t entry;
+	entry.val = page_private(page);
+	if (disk->fops->swap_slot_free_notify && __swap_count(entry) == 1) {
 		unsigned long offset;
 
-		entry.val = page_private(page);
 		offset = swp_offset(entry);
 
 		SetPageDirty(page);

Vinayak Menon

Acked-by Minchan Kim

2019-11-19 10:57 UTC #2 lore raw

Quoted 7 lines · Greg KH

Quoted 4 lines · On Mon, Nov 18, 2019 at 05:37:16PM +0100, [email protected] wrote:
The patch below does not apply to the 4.19-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.
Note, this applies, but just breaks the build, so it needs a backport for 4.19 if people want to see it there.

The version below fixes the build on 4.19.

Quoted 4 lines

thanks,
greg k-h

From 3745cc4bb5cddbc1058889e4f779492060d5e550 Mon Sep 17 00:00:00 2001
From: Vinayak Menon <[email protected]>
Date: Fri, 15 Nov 2019 17:35:00 -0800
Subject: [PATCH] mm/page_io.c: do not free shared swap slots

commit 5df373e95689b9519b8557da7c5bd0db0856d776 upstream.

Pa Pb

fault on VA fault on VA do_swap_page do_swap_page lookup_swap_cache fails lookup_swap_cache fails Pb scheduled out swapin_readahead (deletes zram entry)
swap_free (makes swap_count 1)
Pb scheduled in swap_readpage (swap_count == 1) Takes SWP_SYNCHRONOUS_IO path zram enrty absent zram gives a zero filled page

Fix this by making sure that swap slot is freed only when swap count drops down to one.

Link http://lkml.kernel.org/r/[email protected] open here

Fixes aa8d22a11da9 ("mm: swap: SWP_SYNCHRONOUS_IO: skip swapcache only if swapped page has no other reference")

Signed-off-by Vinayak Menon <[email protected]>

Acked-by Minchan Kim <[email protected]>

Cc Michal Hocko <[email protected]>

Cc Hugh Dickins <[email protected]>

Cc <[email protected]>

Signed-off-by Andrew Morton <[email protected]>

Signed-off-by Linus Torvalds <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
mm/page_io.c | 7 ++++---

 1 file changed, 4 insertions(+), 3 deletions(-)

mm/page_io.c +0 -0

index abc1466..e763047 100644
@@ -77,6 +77,7 @@ static void swap_slot_free_notify(struct page *page)

{
        struct swap_info_struct *sis;
        struct gendisk *disk;
+       swp_entry_t entry;

        /*
         * There is no guarantee that the page is in swap cache - the software @@ -108,11 +109,11 @@ static void swap_slot_free_notify(struct page *page)
         * we again wish to reclaim it.
         */
        disk = sis->bdev->bd_disk;
-       if (disk->fops->swap_slot_free_notify) {
-               swp_entry_t entry;
+       entry.val = page_private(page);
+       if (disk->fops->swap_slot_free_notify &&
+                       __swap_count(sis, entry) == 1) {
                unsigned long offset;

- entry.val = page_private(page);
offset = swp_offset(entry);

SetPageDirty(page);
--
QUALCOMM INDIA, on behalf of Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum, hosted by The Linux Foundation

Quoted 72 lines

Quoted 72 lines
------------------ original commit in Linus's tree ------------------
Quoted 1 line
From 5df373e95689b9519b8557da7c5bd0db0856d776 Mon Sep 17 00:00:00 2001
From: Vinayak Menon <[email protected]>
Date: Fri, 15 Nov 2019 17:35:00 -0800
Subject: [PATCH] mm/page_io.c: do not free shared swap slots
The following race is observed due to which a processes faulting on a swap entry, finds the page neither in swapcache nor swap. This causes zram to give a zero filled page that gets mapped to the process, resulting in a user space crash later.
Consider parent and child processes Pa and Pb sharing the same swap slot with swap_count 2. Swap is on zram with SWP_SYNCHRONOUS_IO set. Virtual address 'VA' of Pa and Pb points to the shared swap entry.
Pa Pb
fault on VA                              fault on VA
do_swap_page                             do_swap_page
lookup_swap_cache fails                  lookup_swap_cache fails
Pb scheduled out
swapin_readahead (deletes zram entry)
swap_free (makes swap_count 1)
Pb scheduled in swap_readpage (swap_count == 1) Takes SWP_SYNCHRONOUS_IO path zram enrty absent zram gives a zero filled page
Fix this by making sure that swap slot is freed only when swap count drops down to one.
Link http://lkml.kernel.org/r/[email protected] open here
Fixes aa8d22a11da9 ("mm: swap: SWP_SYNCHRONOUS_IO: skip swapcache only if swapped page has no other reference")
Signed-off-by Vinayak Menon <[email protected]>
Suggested-by Minchan Kim <[email protected]>
Acked-by Minchan Kim <[email protected]>
Cc Michal Hocko <[email protected]>
Cc Hugh Dickins <[email protected]>
Cc <[email protected]>
Signed-off-by Andrew Morton <[email protected]>
Signed-off-by Linus Torvalds <[email protected]>
mm/page_io.c +3 -3
index 24ee600f9131..60a66a58b9bf 100644
@@ -73,6 +73,7 @@ static void swap_slot_free_notify(struct page *page)
 {
 	struct swap_info_struct *sis;
 	struct gendisk *disk;
+	swp_entry_t entry;
 
 	/*
 	 * There is no guarantee that the page is in swap cache - the software
@@ -104,11 +105,10 @@ static void swap_slot_free_notify(struct page *page)
 	 * we again wish to reclaim it.
 	 */
 	disk = sis->bdev->bd_disk;
-	if (disk->fops->swap_slot_free_notify) {
-		swp_entry_t entry;
+	entry.val = page_private(page);
+	if (disk->fops->swap_slot_free_notify && __swap_count(entry) == 1) {
 		unsigned long offset;
 
-		entry.val = page_private(page);
 		offset = swp_offset(entry);
 
 		SetPageDirty(page);

Greg KH

author maintainer

2019-11-21 20:34 UTC #3 lore raw

Quoted 11 lines · Vinayak Menon

Quoted 7 lines · Greg KH
Quoted 4 lines · On Mon, Nov 18, 2019 at 05:37:16PM +0100, [email protected] wrote:
The patch below does not apply to the 4.19-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.
Note, this applies, but just breaks the build, so it needs a backport for 4.19 if people want to see it there.
The version below fixes the build on 4.19.

The patch you sent was totally corrupted, I couldn't figure out how to fix it up. Please resend it in a format I can apply it in.

thanks,

greg k-h

Sasha Levin

maintainer

2019-11-25 16:43 UTC #4 lore raw

In reply to Vinayak Menon

Quoted 11 lines · Vinayak Menon

Quoted 7 lines · Greg KH
Quoted 4 lines · On Mon, Nov 18, 2019 at 05:37:16PM +0100, [email protected] wrote:
The patch below does not apply to the 4.19-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.
Note, this applies, but just breaks the build, so it needs a backport for 4.19 if people want to see it there.
The version below fixes the build on 4.19.

I've fixed it up based on the version sent by Vinayak and queued it up for 4.19.

Signature · 2 lines

Thanks,
Sasha