linux-kernel - [PATCH linux-next] mm: swap: get rid of deadloop in swapin readahead

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 21 Feb 2022 11:17:49 +0000
From:   cgel.zte@...il.com
To:     akpm@...ux-foundation.org, naoya.horiguchi@....com,
        mhocko@...nel.org, minchan@...nel.org, hannes@...xchg.org
Cc:     rogerq@...nel.org, linux-mm@...ck.org,
        linux-kernel@...r.kernel.org, guo.ziliang@....com.cn,
        Zeal Robot <zealci@....com.cn>,
        Ran Xiaokai <ran.xiaokai@....com.cn>,
        Jiang Xuexin <jiang.xuexin@....com.cn>,
        Yang Yang <yang.yang29@....com.cn>
Subject: [PATCH linux-next] mm: swap: get rid of deadloop in swapin readahead

From: Guo Ziliang <guo.ziliang@....com.cn>

In our testing, a deadloop task was found. Through sysrq printing, same 
stack was found every time, as follows:
__swap_duplicate+0x58/0x1a0
swapcache_prepare+0x24/0x30
__read_swap_cache_async+0xac/0x220
read_swap_cache_async+0x58/0xa0
swapin_readahead+0x24c/0x628
do_swap_page+0x374/0x8a0
__handle_mm_fault+0x598/0xd60
handle_mm_fault+0x114/0x200
do_page_fault+0x148/0x4d0
do_translation_fault+0xb0/0xd4
do_mem_abort+0x50/0xb0

The reason for the deadloop is that swapcache_prepare() always returns
EEXIST, indicating that SWAP_HAS_CACHE has not been cleared, so that
it cannot jump out of the loop. We suspect that the task that clears
the SWAP_HAS_CACHE flag never gets a chance to run. We try to lower
the priority of the task stuck in a deadloop so that the task that
clears the SWAP_HAS_CACHE flag will run. The results show that the
system returns to normal after the priority is lowered.

In our testing, multiple real-time tasks are bound to the same core,
and the task in the deadloop is the highest priority task of the
core, so the deadloop task cannot be preempted.

Although cond_resched() is used by __read_swap_cache_async, it is an
empty function in the preemptive system and cannot achieve the purpose
of releasing the CPU. A high-priority task cannot release the CPU
unless preempted by a higher-priority task. But when this task
is already the highest priority task on this core, other tasks
will not be able to be scheduled. So we think we should replace
cond_resched() with schedule_timeout_uninterruptible(1),
schedule_timeout_interruptible will call set_current_state
first to set the task state, so the task will be removed
from the running queue, so as to achieve the purpose of
giving up the CPU and prevent it from running in kernel
mode for too long.

Reported-by: Zeal Robot <zealci@....com.cn>
Reviewed-by: Ran Xiaokai <ran.xiaokai@....com.cn>
Reviewed-by: Jiang Xuexin <jiang.xuexin@....com.cn>
Reviewed-by: Yang Yang <yang.yang29@....com.cn>
Signed-off-by: Guo Ziliang <guo.ziliang@....com.cn>
---
 mm/swap_state.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mm/swap_state.c b/mm/swap_state.c
index 8d4104242100..ee67164531c0 100644
--- a/mm/swap_state.c
+++ b/mm/swap_state.c
@@ -478,7 +478,7 @@ struct page *__read_swap_cache_async(swp_entry_t entry, gfp_t gfp_mask,
 		 * __read_swap_cache_async(), which has set SWAP_HAS_CACHE
 		 * in swap_map, but not yet added its page to swap cache.
 		 */
-		cond_resched();
+		schedule_timeout_uninterruptible(1);
 	}

 	/*
-- 
2.15.2