linux-kernel - [Question] Is there a race window between swapoff vs synchronous swap

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <364d7ce9-ccb7-fa04-7067-44a96be87060@huawei.com>
Date:   Mon, 29 Mar 2021 21:18:20 +0800
From:   Miaohe Lin <linmiaohe@...wei.com>
To:     Linux-MM <linux-mm@...ck.org>,
        linux-kernel <linux-kernel@...r.kernel.org>
CC:     Andrew Morton <akpm@...ux-foundation.org>,
        Matthew Wilcox <willy@...radead.org>,
        Yu Zhao <yuzhao@...gle.com>,
        Shakeel Butt <shakeelb@...gle.com>,
        Alex Shi <alex.shi@...ux.alibaba.com>,
        Huang Ying <ying.huang@...el.com>
Subject: [Question] Is there a race window between swapoff vs synchronous
 swap_readpage

Hi all,
I am investigating the swap code, and I found the below possible race window:

CPU 1							CPU 2
-----							-----
do_swap_page
  skip swapcache case (synchronous swap_readpage)
    alloc_page_vma
							swapoff
							  release swap_file, bdev, or ...
      swap_readpage
	check sis->flags is ok
	  access swap_file, bdev or ...[oops!]
							    si->flags = 0

The swapcache case is ok because swapoff will wait on the page_lock of swapcache page.
Is this will really happen or Am I miss something ?
Any reply would be really grateful. Thanks! :)