mm: fix race condition in MADV_FREE
Status from this message: [merged] mm-fix-data-corruption-caused-by-lazyfree-page.patch removed from -mm tree
Get series with b4
b4 am [email protected]Versions newest first · linked by author and title
- v3 Latest2 patches 6 repliesApplied 2/2
- v22 patches 4 repliesSuperseded
- v12 patches 3 repliesSuperseded
Changes in v3 from the cover letter
- reword patch log and code comments, no code change
Patches in v3 All 2 applied
| # | Subject and files | Size | Replies | Applied |
|---|---|---|---|---|
| 1/2 | mm: avoid marking swap cached page as lazyfreemm/ | +2 | 3 replies | Applied |
| 2/2 | mm: fix data corruption caused by lazyfree pagemm/ | +11 | 3 replies | Applied |
Reviews trailers per patch
All 2 patches have a Reviewed-by or Acked-by.
| Patch | Artem Savkov | Rik van Riel | Michal Hocko | Johannes Weiner | Minchan Kim |
|---|---|---|---|---|---|
| 1/2 | Reported-and-tested-by | R-b | A-b | A-b | A-b |
| 2/2 | A-b | A-b |
Trailers given in replies are filled; those carried in the patches from earlier versions are outlined with dashes. Scroll the table sideways for all 5 reviewers.
Cover letter [PATCH V3 0/2] mm: fix race condition in MADV_FREE
From: Shaohua Li <[email protected]>
Artem Savkov reported a race condition[1] in MADV_FREE. MADV_FREE clear pte dirty bit and then mark the page lazyfree. There is no lock to prevent the page is added to swap cache between these two steps by page reclaim. There are two problems:
- page in swapcache is marked lazyfree (clear SwapBacked). This confuses some code pathes, like page fault handling.
- The page is added into swapcache, and freed but the page isn't swapout because pte isn't dirty. This will cause data corruption.
The patches will fix the issues.
I knew Minchan suggested these should be combined to one patch, but I really think the separation makes things clearer because these are two issues even they are stemmed from the same race.
Thanks,
Shaohua
V2->V3:
- reword patch log and code comments, no code change
V1->V2:
- dirty page in add_to_swap instead of in shrink_page_list as suggested by Minchan
Shaohua Li (2):
mm: avoid marking swap cached page as lazyfree
mm: fix data corruption caused by lazyfree page
mm/swap.c | 4 ++-- mm/swap_state.c | 11 +++++++++++ 2 files changed, 13 insertions(+), 2 deletions(-)
Signature · 7 lines
2.9.5 -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to [email protected]. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: <a href=mailto:"[email protected]"> [email protected] </a>