• Hugh Dickins's avatar
    mm: further fix swapin race condition · 31c4a3d3
    Hugh Dickins authored
    Commit 4969c119 ("mm: fix swapin race condition") is now agreed to
    be incomplete.  There's a race, not very much less likely than the
    original race envisaged, in which it is further necessary to check that
    the swapcache page's swap has not changed.
    
    Here's the reasoning: cast in terms of reuse_swap_page(), but probably
    could be reformulated to rely on try_to_free_swap() instead, or on
    swapoff+swapon.
    
    A, faults into do_swap_page(): does page1 = lookup_swap_cache(swap1) and
    comes through the lock_page(page1).
    
    B, a racing thread of the same process, faults on the same address: does
    page1 = lookup_swap_cache(swap1) and now waits in lock_page(page1), but
    for whatever reason is unlucky not to get the lock any time soon.
    
    A carries on through do_swap_page(), a write fault, but cannot reuse the
    swap page1 (another reference to swap1).  Unlocks the page1 (but B
    doesn't get it yet), does COW in do_wp_page(), page2 now in that pte.
    
    C, perhaps the parent of A+B, comes in and write faults the same swap
    page1 into its mm, reuse_swap_page() succeeds this time, swap1 is freed.
    
    kswapd comes in after some time (B still unlucky) and swaps out some
    pages from A+B and C: it allocates the original swap1 to page2 in A+B,
    and some other swap2 to the original page1 now in C.  But does not
    immediately free page1 (actually it couldn't: B holds a reference),
    leaving it in swap cache for now.
    
    B at last gets the lock on page1, hooray! Is PageSwapCache(page1)? Yes.
    Is pte_same(*page_table, orig_pte)? Yes, because page2 has now been
    given the swap1 which page1 used to have.  So B proceeds to insert page1
    into A+B's page_table, though its content now belongs to C, quite
    different from what A wrote there.
    
    B ought to have checked that page1's swap was still swap1.
    Signed-off-by: default avatarHugh Dickins <hughd@google.com>
    Reviewed-by: default avatarRik van Riel <riel@redhat.com>
    Cc: stable@kernel.org
    Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    31c4a3d3
memory.c 97.1 KB