Page corruption with SWP_SYNCHRONOUS_IO

Page corruption with SWP_SYNCHRONOUS_IO

[Vinayak Menon]

Hi,

On 4.14 kernel with SWP_SYNCHRONOUS_IO patches ported, we are seeing an issue which is not reproducible
with SWP_SYNCHRONOUS_IO for zram is disabled. Its arm64 system with 3GB of RAM. Note that zram writeback
is not enabled and backing_dev is not set. The issue is very hard to reproduce and requires low memory
situation to the level of thrashing.

Observations

1) Android zygote crash due to NULL pointer dereference. The page from which it picks the wrong pointer
is completely zeroed out. Since its always in zygote process context and probably points to role of fork
and pages shared between processes.

2) The issue always happens on anon pages.

3) The corrupted page is entirely filled with zero. Always. Never other pattern. And the page owner shows
that the page is read from zram in all cases (in most case its a write and thus followed by wp_page_copy).
Probably a case of fault finding a missing zram entry and zero filled page being returned by zram.

My attempts to write a test case to reproduce this is not successful yet. And I don't see a way to test this on latest kernel.

Thanks,

Vinayak