linux-kernel - Re: [RFC PATCH] mm: add folio in swapcache if swapin from zswap

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Sat, 23 Mar 2024 10:41:32 +1300
From: Barry Song <21cnbao@...il.com>
To: Yosry Ahmed <yosryahmed@...gle.com>
Cc: chengming.zhou@...ux.dev, hannes@...xchg.org, nphamcs@...il.com, 
	akpm@...ux-foundation.org, linux-mm@...ck.org, linux-kernel@...r.kernel.org, 
	Zhongkun He <hezhongkun.hzk@...edance.com>
Subject: Re: [RFC PATCH] mm: add folio in swapcache if swapin from zswap

On Sat, Mar 23, 2024 at 8:38 AM Yosry Ahmed <yosryahmed@...gle.com> wrote:
>
> On Fri, Mar 22, 2024 at 9:40 AM <chengming.zhou@...ux.dev> wrote:
> >
> > From: Chengming Zhou <chengming.zhou@...ux.dev>
> >
> > There is a report of data corruption caused by double swapin, which is
> > only possible in the skip swapcache path on SWP_SYNCHRONOUS_IO backends.
> >
> > The root cause is that zswap is not like other "normal" swap backends,
> > it won't keep the copy of data after the first time of swapin. So if

I don't quite understand this, so once we load a page from zswap, zswap
will free it even though do_swap_page might not set it to PTE?

shouldn't zswap free the memory after notify_free just like zram?

> > the folio in the first time of swapin can't be installed in the pagetable
> > successfully and we just free it directly. Then in the second time of
> > swapin, we can't find anything in zswap and read wrong data from swapfile,
> > so this data corruption problem happened.
> >
> > We can fix it by always adding the folio into swapcache if we know the
> > pinned swap entry can be found in zswap, so it won't get freed even though
> > it can't be installed successfully in the first time of swapin.
>
> A concurrent faulting thread could have already checked the swapcache
> before we add the folio to it, right? In this case, that thread will
> go ahead and call swap_read_folio() anyway.
>
> Also, I suspect the zswap lookup might hurt performance. Would it be
> better to add the folio back to zswap upon failure? This should be
> detectable by checking if the folio is dirty as I mentioned in the bug
> report thread.

I don't like the idea either as sync-io is the fast path for zram etc.
or, can we use
the way of zram to free compressed data?

>