linux-kernel - Re: [Question] Is there a race window between swapoff vs synchronous swap

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 30 Mar 2021 19:21:54 +0800
From:   Miaohe Lin <linmiaohe@...wei.com>
To:     "Huang, Ying" <ying.huang@...el.com>
CC:     Linux-MM <linux-mm@...ck.org>,
        linux-kernel <linux-kernel@...r.kernel.org>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Matthew Wilcox <willy@...radead.org>,
        Yu Zhao <yuzhao@...gle.com>,
        "Shakeel Butt" <shakeelb@...gle.com>,
        Alex Shi <alex.shi@...ux.alibaba.com>,
        "Minchan Kim" <minchan@...nel.org>
Subject: Re: [Question] Is there a race window between swapoff vs synchronous
 swap_readpage

On 2021/3/30 11:44, Huang, Ying wrote:
> Miaohe Lin <linmiaohe@...wei.com> writes:
> 
>> On 2021/3/30 9:57, Huang, Ying wrote:
>>> Hi, Miaohe,
>>>
>>> Miaohe Lin <linmiaohe@...wei.com> writes:
>>>
>>>> Hi all,
>>>> I am investigating the swap code, and I found the below possible race window:
>>>>
>>>> CPU 1							CPU 2
>>>> -----							-----
>>>> do_swap_page
>>>>   skip swapcache case (synchronous swap_readpage)
>>>>     alloc_page_vma
>>>> 							swapoff
>>>> 							  release swap_file, bdev, or ...
>>>>       swap_readpage
>>>> 	check sis->flags is ok
>>>> 	  access swap_file, bdev or ...[oops!]
>>>> 							    si->flags = 0
>>>>
>>>> The swapcache case is ok because swapoff will wait on the page_lock of swapcache page.
>>>> Is this will really happen or Am I miss something ?
>>>> Any reply would be really grateful. Thanks! :)
>>>
>>> This appears possible.  Even for swapcache case, we can't guarantee the
>>
>> Many thanks for reply!
>>
>>> swap entry gotten from the page table is always valid too.  The
>>
>> The page table may change at any time. And we may thus do some useless work.
>> But the pte_same() check could handle these races correctly if these do not
>> result in oops.
>>
>>> underlying swap device can be swapped off at the same time.  So we use
>>> get/put_swap_device() for that.  Maybe we need similar stuff here.
>>
>> Using get/put_swap_device() to guard against swapoff for swap_readpage() sounds
>> really bad as swap_readpage() may take really long time. Also such race may not be
>> really hurtful because swapoff is usually done when system shutdown only.
>> I can not figure some simple and stable stuff out to fix this. Any suggestions or
>> could anyone help get rid of such race?
> 
> Some reference counting on the swap device can prevent swap device from
> swapping-off.  To reduce the performance overhead on the hot-path as
> much as possible, it appears we can use the percpu_ref.
> 

Sounds a good idea. Many thanks for your suggestion. :)

> Best Regards,
> Huang, Ying
> .
>