linux-kernel - [PATCH] mm: zswap: invaldiate entry after writeback

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20230614143122.74471-1-cerasuolodomenico@gmail.com>
Date:   Wed, 14 Jun 2023 16:31:22 +0200
From:   Domenico Cerasuolo <cerasuolodomenico@...il.com>
To:     sjenning@...hat.com, ddstreet@...e.org, vitaly.wool@...sulko.com
Cc:     yosryahmed@...gle.com, hannes@...xchg.org, nphamcs@...il.com,
        akpm@...ux-foundation.org, linux-mm@...ck.org,
        linux-kernel@...r.kernel.org, kernel-team@...a.com,
        Domenico Cerasuolo <cerasuolodomenico@...il.com>
Subject: [PATCH] mm: zswap: invaldiate entry after writeback

When an entry started writeback, it used to be invalidated with ref
count logic alone, meaning that it would stay on the tree until all
references were put. The problem with this behavior is that as soon as
the writeback started, the ownership of the data held by the entry is
passed to the swapcache and should not be left in zswap too.
Currently there are no known issues because of this, but this change
explicitly invalidates an entry that started writeback to reduce
opportunities for future bugs.

This patch is a follow up on the series titled "mm: zswap: move
writeback LRU from zpool to zswap" with message id
<20230612093815.133504-1-cerasuolodomenico@...il.com> in mm-unstable +
commit f090b7949768("mm: zswap: support exclusive loads") that's in
mm-unstable as well.

Suggested-by: Johannes Weiner <hannes@...xchg.org>
Signed-off-by: Domenico Cerasuolo <cerasuolodomenico@...il.com>
---
 mm/zswap.c | 33 +++++++++++++++++----------------
 1 file changed, 17 insertions(+), 16 deletions(-)

diff --git a/mm/zswap.c b/mm/zswap.c
index 02d0a6f46f4a..c122f042a49d 100644
--- a/mm/zswap.c
+++ b/mm/zswap.c
@@ -599,6 +599,16 @@ static struct zswap_pool *zswap_pool_find_get(char *type, char *compressor)
 	return NULL;
 }
 
+static void zswap_invalidate_entry(struct zswap_tree *tree,
+				   struct zswap_entry *entry)
+{
+	/* remove from rbtree */
+	zswap_rb_erase(&tree->rbroot, entry);
+
+	/* drop the initial reference from entry creation */
+	zswap_entry_put(tree, entry);
+}
+
 static int zswap_reclaim_entry(struct zswap_pool *pool)
 {
 	struct zswap_entry *entry;
@@ -644,12 +654,13 @@ static int zswap_reclaim_entry(struct zswap_pool *pool)
 		goto put_unlock;
 	}
 
-	/* Check for invalidate() race */
-	if (entry != zswap_rb_search(&tree->rbroot, swpoffset))
-		goto put_unlock;
-
-	/* Drop base reference */
-	zswap_entry_put(tree, entry);
+	/*
+	 * Writeback started successfully, the page now belongs to the
+	 * swapcache. Drop the entry from zswap - unless invalidate already
+	 * took it out while we had the tree->lock released for IO.
+	 */
+	if (entry == zswap_rb_search(&tree->rbroot, swpoffset))
+		zswap_invalidate_entry(tree, entry);
 
 put_unlock:
 	/* Drop local reference */
@@ -1376,16 +1387,6 @@ static int zswap_frontswap_store(unsigned type, pgoff_t offset,
 	goto reject;
 }
 
-static void zswap_invalidate_entry(struct zswap_tree *tree,
-				   struct zswap_entry *entry)
-{
-	/* remove from rbtree */
-	zswap_rb_erase(&tree->rbroot, entry);
-
-	/* drop the initial reference from entry creation */
-	zswap_entry_put(tree, entry);
-}
-
 /*
  * returns 0 if the page was successfully decompressed
  * return -1 on entry not found or error
-- 
2.34.1