linux-kernel - Re: [Question] Is there a race window between swapoff vs synchronous swap

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <0cb765aa-1783-cd62-c4a4-b3fbc620532d@huawei.com>
Date:   Tue, 30 Mar 2021 11:15:52 +0800
From:   Miaohe Lin <linmiaohe@...wei.com>
To:     "Huang, Ying" <ying.huang@...el.com>
CC:     Linux-MM <linux-mm@...ck.org>,
        linux-kernel <linux-kernel@...r.kernel.org>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Matthew Wilcox <willy@...radead.org>,
        Yu Zhao <yuzhao@...gle.com>,
        "Shakeel Butt" <shakeelb@...gle.com>,
        Alex Shi <alex.shi@...ux.alibaba.com>,
        "Minchan Kim" <minchan@...nel.org>
Subject: Re: [Question] Is there a race window between swapoff vs synchronous
 swap_readpage

On 2021/3/30 9:57, Huang, Ying wrote:
> Hi, Miaohe,
> 
> Miaohe Lin <linmiaohe@...wei.com> writes:
> 
>> Hi all,
>> I am investigating the swap code, and I found the below possible race window:
>>
>> CPU 1							CPU 2
>> -----							-----
>> do_swap_page
>>   skip swapcache case (synchronous swap_readpage)
>>     alloc_page_vma
>> 							swapoff
>> 							  release swap_file, bdev, or ...
>>       swap_readpage
>> 	check sis->flags is ok
>> 	  access swap_file, bdev or ...[oops!]
>> 							    si->flags = 0
>>
>> The swapcache case is ok because swapoff will wait on the page_lock of swapcache page.
>> Is this will really happen or Am I miss something ?
>> Any reply would be really grateful. Thanks! :)
> 
> This appears possible.  Even for swapcache case, we can't guarantee the

Many thanks for reply!

> swap entry gotten from the page table is always valid too.  The

The page table may change at any time. And we may thus do some useless work.
But the pte_same() check could handle these races correctly if these do not
result in oops.

> underlying swap device can be swapped off at the same time.  So we use
> get/put_swap_device() for that.  Maybe we need similar stuff here.

Using get/put_swap_device() to guard against swapoff for swap_readpage() sounds
really bad as swap_readpage() may take really long time. Also such race may not be
really hurtful because swapoff is usually done when system shutdown only.
I can not figure some simple and stable stuff out to fix this. Any suggestions or
could anyone help get rid of such race?

Anyway, thanks again!

> 
> Best Regards,
> Huang, Ying
> .
>