linux-kernel - Whether is the race for SWP_SYNCHRONOUS_IO possible? (was Re: [PATCH v3 6/7] mm/swap, shmem: use unified swapin helper for shmem)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <87bk92gqpx.fsf_-_@yhuang6-desk2.ccr.corp.intel.com>
Date: Wed, 31 Jan 2024 10:51:38 +0800
From: "Huang, Ying" <ying.huang@...el.com>
To: Minchan Kim <minchan@...nel.org>
Cc: Kairui Song <ryncsn@...il.com>, linux-mm@...ck.org,  Kairui Song
 <kasong@...cent.com>,  Andrew Morton <akpm@...ux-foundation.org>,  Chris
 Li <chrisl@...nel.org>,  Hugh Dickins <hughd@...gle.com>,  Johannes Weiner
 <hannes@...xchg.org>,  Matthew Wilcox <willy@...radead.org>,  Michal Hocko
 <mhocko@...e.com>,  Yosry Ahmed <yosryahmed@...gle.com>,  David
 Hildenbrand <david@...hat.com>,  linux-kernel@...r.kernel.org, Yu Zhao
 <yuzhao@...gle.com>
Subject: Whether is the race for SWP_SYNCHRONOUS_IO possible? (was Re:
 [PATCH v3 6/7] mm/swap, shmem: use unified swapin helper for shmem)

Hi, Minchan,

When I review the patchset from Kairui, I checked the code to skip swap
cache in do_swap_page() for swap device with SWP_SYNCHRONOUS_IO.  Is the
following race possible?  Where a page is swapped out to a swap device
with SWP_SYNCHRONOUS_IO and the swap count is 1.  Then 2 threads of the
process runs on CPU0 and CPU1 as below.  CPU0 is running do_swap_page().

CPU0				CPU1
----				----
swap_cache_get_folio()
check sync io and swap count
alloc folio
swap_readpage()
folio_lock_or_retry()
				swap in the swap entry
				write page
				swap out to same swap entry
pte_offset_map_lock()
check pte_same()
swap_free()   <-- new content lost!
set_pte_at()  <-- stale page!
folio_unlock()
pte_unmap_unlock()

Do I miss anything?

--
Best Regards,
Huang, Ying