From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 95B59C77B7F for ; Thu, 4 May 2023 02:29:06 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 2DF106B0075; Wed, 3 May 2023 22:29:06 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 28F356B007D; Wed, 3 May 2023 22:29:06 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 17E736B007E; Wed, 3 May 2023 22:29:06 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from mail-qk1-f175.google.com (mail-qk1-f175.google.com [209.85.222.175]) by kanga.kvack.org (Postfix) with ESMTP id E652F6B0075 for ; Wed, 3 May 2023 22:29:05 -0400 (EDT) Received: by mail-qk1-f175.google.com with SMTP id af79cd13be357-74d765f2180so546290285a.1 for ; Wed, 03 May 2023 19:29:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cmpxchg-org.20221208.gappssmtp.com; s=20221208; t=1683167345; x=1685759345; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:from:to:cc:subject:date:message-id:reply-to; bh=EN98kruW+UyajuDoJOOXmJ6SnmFPGvXcjLV0DXjMEmM=; b=r2qVglpG+tNTYcg16qpuf9/eKF1z+vZ3oEe0tXEUbkRR2CIQGizdv9FiO5fGhNPt0e SS8+GqPEebxukquzwH50Kmf9MvHqTyEwa6sul8NT3jbedM2WVsgYMM7lN2BDTkGktwVk +MbAwdxPldNJBhyH0N71/TdEDKKR02XX4sXowzHkwSKKlqbHui0jTDahJmasPA3To7ar TW4nPxCCDIJnA4DN3uTTFf4vWGOaUcjzxHr2OBXYmVXp8Tpz4zYp5tlcw4GOQJmlIYPm pe3tIvY+1tj2YIrSSpRuz1Q1OHLFx+wP7qiZIABx6q2EF8KVGenL1dpGugsVSV/sdozj uYZg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1683167345; x=1685759345; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=EN98kruW+UyajuDoJOOXmJ6SnmFPGvXcjLV0DXjMEmM=; b=TiA5zttzbxWXI8FCpwTIIIX3jfoCjIgHe8lyQcdBxRUFglEnDkBystl5FhwwDRpJ8o 4H+xmstpvHbG4HeFdKSqWZteP6oiDbRhVD2JR+Uzge1FN4CTpZGS69mPqm9CJlOLaL1o LIr/g7jmIIYs8B7WS3Wk07E5/iNBCpmBMiUaJnlecfMs+K7TzFaHpIC1ba++k2DDsBJY MH7n7XMYeN+9oNELSj9WHXTpBrK4ymC0uZm0RYmWSTIdG0ODV6YXVfFU10oYYiUfVgtC KrUScPNyNsxarFvYL6f7UIQNHp8htFjQqqysolb4bZPl+PCBsc7Pd0Hpzwa3Auwz4193 fMmg== X-Gm-Message-State: AC+VfDz+Y1z8HnO+vQULj9kBTlRvaCpUa4wfDRv+RX4T9kFHB3AuN/8e C31oVhUwyFbC7SMt++1qNCX/bw== X-Google-Smtp-Source: ACHHUZ5c3ftEeeDH6kHUr7jXEXv6cF2lQWdHfegMSQDGKoh5DLnyGvBQA5/MYnqd3Do0hwciOMOoBA== X-Received: by 2002:a05:622a:1495:b0:3ef:612c:58a1 with SMTP id t21-20020a05622a149500b003ef612c58a1mr3319622qtx.62.1683167345532; Wed, 03 May 2023 19:29:05 -0700 (PDT) Received: from localhost ([2620:10d:c091:400::5:1366]) by smtp.gmail.com with ESMTPSA id f17-20020ac86ed1000000b003ef2db16e72sm11960190qtv.94.2023.05.03.19.29.05 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 03 May 2023 19:29:05 -0700 (PDT) Date: Wed, 3 May 2023 22:29:04 -0400 From: Johannes Weiner To: Chris Li Cc: Domenico Cerasuolo , sjenning@redhat.com, ddstreet@ieee.org, vitaly.wool@konsulko.com, minchan@kernel.org, ngupta@vflare.org, akpm@linux-foundation.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH v2] mm: fix zswap writeback race condition Message-ID: <20230504022904.GA202700@cmpxchg.org> References: <20230503151200.19707-1-cerasuolodomenico@gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Wed, May 03, 2023 at 02:59:31PM -0700, Chris Li wrote: > Hi Domenico, > > On Wed, May 03, 2023 at 05:12:00PM +0200, Domenico Cerasuolo wrote: > > 1. a page with data A and swap offset X is stored in zswap > > 2. page A is removed off the LRU by zpool driver for writeback in > > zswap-shrink work, data for A is mapped by zpool driver > > 3. user space program faults and invalidates page entry A, offset X is > > considered free > > 4. kswapd stores page B at offset X in zswap (zswap could also be full, > > if so, page B would then be IOed to X, then skip step 5.) > > 5. entry A is replaced by B in tree->rbroot, this doesn't affect the > > local reference held by zswap-shrink work > > 6. zswap-shrink work writes back A at X, and frees zswap entry A > > 7. swapin of slot X brings A in memory instead of B > > Thanks for the interesting discovery. > > > V2: > > - updated comment with better explaination of the situation being > > addressed in the check > > > > Signed-off-by: Domenico Cerasuolo > > Acked-by: Johannes Weiner > > --- > > mm/zswap.c | 16 ++++++++++++++++ > > 1 file changed, 16 insertions(+) > > > > diff --git a/mm/zswap.c b/mm/zswap.c > > index f6c89049cf70..5d5977c9ea45 100644 > > --- a/mm/zswap.c > > +++ b/mm/zswap.c > > @@ -995,6 +995,22 @@ static int zswap_writeback_entry(struct zpool *pool, unsigned long handle) > > goto fail; > > > > case ZSWAP_SWAPCACHE_NEW: /* page is locked */ ^^^^^^^^^^^^^^^^^^^^ > > + /* > > + * Having a local reference to the zswap entry doesn't exclude > > + * swapping from invalidating and recycling the swap slot. Once > > + * the swapcache is secured against concurrent swapping to and > > + * from the slot, recheck that the entry is still current before > > + * writing. > > + */ > > + spin_lock(&tree->lock); > > + if (zswap_rb_search(&tree->rbroot, entry->offset) != entry) { > > + spin_unlock(&tree->lock); > > + delete_from_swap_cache(page_folio(page)); > > + ret = -ENOMEM; > > + goto fail; > > + } > > + spin_unlock(&tree->lock); > > + > > The race condition is still there, just making it much harder to hit. > What happens after you perform the rb tree search, release tree lock. > Then the entry gets invalid and recycled right here before the decompress > step? Recyling can only happen up until we see ZSWAP_SWAPCACHE_NEW. Once we see it, we're holding the page lock* on a new swapcache page for a valid, in-use** swp_entry_t. The lock of the swapcache page prevents swapin, which would be required for the count to drop and the entry to be recycled. __read_swap_cache_async() checked that the entry is valid, so the slot cannot be allocated to someone else. Now we just have to check if that entry is the right one, iow the slot wasn't recycled. If the slot wasn't recycled, we know we have the right data and we can start the IO and unlock the page. (After that swapins can continue and the data can change, but regular writeback vs redirtying rules apply.) If the slot was indeed recycled before we get ZSWAP_SWAPCACHE_NEW, we see the mismatch, delete the page from the swapcache and unlock it. A racing do_swap_page() may have found and reffed the page in swapcache, and acquire the page lock after us; but it'll see it's no longer in the swapcache, drop the reference (free the page) and retry the fault.