• Huang Ying's avatar
    mm/mincore.c: fix race between swapoff and mincore · 8aaa5eef
    Huang Ying authored
    [ Upstream commit aeb309b8 ]
    
    Via commit 4b3ef9da ("mm/swap: split swap cache into 64MB trunks"),
    after swapoff, the address_space associated with the swap device will be
    freed.  So swap_address_space() users which touch the address_space need
    some kind of mechanism to prevent the address_space from being freed
    during accessing.
    
    When mincore processes an unmapped range for swapped shmem pages, it
    doesn't hold the lock to prevent swap device from being swapped off.  So
    the following race is possible:
    
    CPU1					CPU2
    do_mincore()				swapoff()
      walk_page_range()
        mincore_unmapped_range()
          __mincore_unmapped_range
            mincore_page
    	  as = swap_address_space()
              ...				  exit_swap_address_space()
              ...				    kvfree(spaces)
    	  find_get_page(as)
    
    The address space may be accessed after being freed.
    
    To fix the race, get_swap_device()/put_swap_device() is used to enclose
    find_get_page() to check whether the swap entry is valid and prevent the
    swap device from being swapoff during accessing.
    
    Link: http://lkml.kernel.org/r/20190611020510.28251-1-ying.huang@intel.com
    Fixes: 4b3ef9da ("mm/swap: split swap cache into 64MB trunks")
    Signed-off-by: default avatar"Huang, Ying" <ying.huang@intel.com>
    Reviewed-by: default avatarAndrew Morton <akpm@linux-foundation.org>
    Acked-by: default avatarMichal Hocko <mhocko@suse.com>
    Cc: Hugh Dickins <hughd@google.com>
    Cc: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
    Cc: Minchan Kim <minchan@kernel.org>
    Cc: Johannes Weiner <hannes@cmpxchg.org>
    Cc: Tim Chen <tim.c.chen@linux.intel.com>
    Cc: Mel Gorman <mgorman@techsingularity.net>
    Cc: Jérôme Glisse <jglisse@redhat.com>
    Cc: Andrea Arcangeli <aarcange@redhat.com>
    Cc: Yang Shi <yang.shi@linux.alibaba.com>
    Cc: David Rientjes <rientjes@google.com>
    Cc: Rik van Riel <riel@redhat.com>
    Cc: Jan Kara <jack@suse.cz>
    Cc: Dave Jiang <dave.jiang@intel.com>
    Cc: Daniel Jordan <daniel.m.jordan@oracle.com>
    Cc: Andrea Parri <andrea.parri@amarulasolutions.com>
    Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
    Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
    8aaa5eef
mincore.c 7.5 KB