linux-kernel - [PATCH V2] mm/swap: take folio refcount after testing the LRU flag

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <1723461718-5503-1-git-send-email-yangge1116@126.com>
Date: Mon, 12 Aug 2024 19:21:58 +0800
From: yangge1116@....com
To: akpm@...ux-foundation.org
Cc: linux-mm@...ck.org,
	linux-kernel@...r.kernel.org,
	21cnbao@...il.com,
	david@...hat.com,
	baolin.wang@...ux.alibaba.com,
	liuzixing@...on.cn,
	yangge <yangge1116@....com>
Subject: [PATCH V2] mm/swap: take folio refcount after testing the LRU flag

From: yangge <yangge1116@....com>

Whoever passes a folio to __folio_batch_add_and_move() must hold
a reference, otherwise something else would already be messed up.
If the folio is referenced, it will not be freed elsewhere, so we
can safely clear the folio's lru flag. As discussed with David
in [1], we should take the reference after testing the LRU flag,
not before.

Link: https://lore.kernel.org/lkml/d41865b4-d6fa-49ba-890a-921eefad27dd@redhat.com/ [1]
Signed-off-by: yangge <yangge1116@....com>
Acked-by: David Hildenbrand <david@...hat.com>
---
 mm/swap.c | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

V2:
   Add sanity check suggested by David

diff --git a/mm/swap.c b/mm/swap.c
index 67a2467..c048659 100644
--- a/mm/swap.c
+++ b/mm/swap.c
@@ -226,12 +226,11 @@ static void __folio_batch_add_and_move(struct folio_batch __percpu *fbatch,
 {
 	unsigned long flags;
 
-	folio_get(folio);
-
-	if (on_lru && !folio_test_clear_lru(folio)) {
-		folio_put(folio);
+	if (on_lru && !folio_test_clear_lru(folio))
 		return;
-	}
+
+	VM_WARN_ON_ONCE(!folio_ref_count(folio));
+	folio_get(folio);
 
 	if (disable_irq)
 		local_lock_irqsave(&cpu_fbatches.lock_irq, flags);
-- 
2.7.4