linux-kernel - [PATCH] mm: Free unused swap cache page in write protection fault handler

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 13 Jan 2021 10:42:41 +0800
From:   Huang Ying <ying.huang@...el.com>
To:     Andrew Morton <akpm@...ux-foundation.org>
Cc:     linux-mm@...ck.org, linux-kernel@...r.kernel.org,
        Huang Ying <ying.huang@...el.com>,
        Linus Torvalds <torvalds@...ux-foundation.org>,
        Peter Xu <peterx@...hat.com>, Hugh Dickins <hughd@...gle.com>,
        Johannes Weiner <hannes@...xchg.org>,
        Mel Gorman <mgorman@...e.de>, Rik van Riel <riel@...riel.com>,
        Andrea Arcangeli <aarcange@...hat.com>,
        Michal Hocko <mhocko@...nel.org>,
        Dave Hansen <dave.hansen@...el.com>,
        Tim Chen <tim.c.chen@...el.com>
Subject: [PATCH] mm: Free unused swap cache page in write protection fault handler

Commit 09854ba94c6a ("mm: do_wp_page() simplification") introduces an
issue as follows.

On a system with free memory as follow before test,

              total        used        free      shared  buff/cache   available
Mem:        1697300      160156     1459220        8648       77924     1419724
Swap:       1048572           0           0

The AnonPages filed of /proc/meminfo is 11712 kB.  After running a
memory eater which will trigger many swapins and write protection
faults, the free memory becomes,

              total        used        free      shared  buff/cache   available
Mem:        1697300      352620     1309004         624       35676     1252380
Swap:       1048572      216924      831648

While the /proc/meminfo shows,

SwapCached:       198908 kB
AnonPages:          1956 kB

Then, with `swapoff -a`, the free memory becomes,

              total        used        free      shared  buff/cache   available
Mem:        1697300      161972     1488184        8648       47144     1433172
Swap:             0           0           0

That is, after swapins and write protection faults, many unused swap
cache pages will be left unfreed in system.  Although the following
page reclaiming or swapoff will free these pages, it's still better to
free these pages at the first place.

So in this patch, at the end of wp_page_copy(), the old unused swap
cache page will be tried to be freed.  With that, after running the
memory eater which will trigger many swapins and write protection
faults, the free memory is,

              total        used        free      shared  buff/cache   available
Mem:        1697300      154020     1509400        1212       33880     1451524
Swap:       1048572       18432     1030140

While the /proc/meminfo shows,

SwapCached:         1240 kB
AnonPages:          1904 kB

BTW: I think this should be in stable after v5.9.

Fixes: 09854ba94c6a ("mm: do_wp_page() simplification")
Signed-off-by: "Huang, Ying" <ying.huang@...el.com>
Cc: Linus Torvalds <torvalds@...ux-foundation.org>
Cc: Peter Xu <peterx@...hat.com>
Cc: Hugh Dickins <hughd@...gle.com>
Cc: Johannes Weiner <hannes@...xchg.org>
Cc: Mel Gorman <mgorman@...e.de>
Cc: Rik van Riel <riel@...riel.com>
Cc: Andrea Arcangeli <aarcange@...hat.com>
Cc: Michal Hocko <mhocko@...nel.org>
Cc: Dave Hansen <dave.hansen@...el.com>
Cc: Tim Chen <tim.c.chen@...el.com>
---
 mm/memory.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/mm/memory.c b/mm/memory.c
index feff48e1465a..2abaff1befcb 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -2963,6 +2963,11 @@ static vm_fault_t wp_page_copy(struct vm_fault *vmf)
 				munlock_vma_page(old_page);
 			unlock_page(old_page);
 		}
+		if (page_copied && PageSwapCache(old_page) &&
+		    !page_mapped(old_page) && trylock_page(old_page)) {
+			try_to_free_swap(old_page);
+			unlock_page(old_page);
+		}
 		put_page(old_page);
 	}
 	return page_copied ? VM_FAULT_WRITE : 0;
-- 
2.29.2