https://github.com/torvalds/linux
Revision 5b808a2300a5ac45f4798ebfac8b367e98a4b692 authored by Krzysztof Kozlowski on 16 October 2013, 20:47:06 UTC, committed by Linus Torvalds on 17 October 2013, 04:35:53 UTC
Fix race between swapoff and swapon.  Swapoff used old_block_size from
swap_info outside of swapon_mutex so it could be overwritten by
concurrent swapon.

The race has visible effect only if more than one swap block device
exists with different block sizes (e.g.  /dev/sda1 with block size 4096
and /dev/sdb1 with 512).  In such case it leads to setting the blocksize
of swapped off device with wrong blocksize.

The bug can be triggered with multiple concurrent swapoff and swapon:
0. Swap for some device is on.
1. swapoff:
First the swapoff is called on this device and "struct swap_info_struct
*p" is assigned. This is done under swap_lock however this lock is
released for the call try_to_unuse().

2. swapon:
After the assignment above (and before acquiring swapon_mutex &
swap_lock by swapoff) the swapon is called on the same device.
The p->old_block_size is assigned to the value of block_size the device.
This block size should be the same as previous but sometimes it is not.
The swapon ends successfully.

3. swapoff:
Swapoff resumes, grabs the locks and mutex and continues to disable this
swap device. Now it sets the block size to value taken from swap_info
which was overwritten by swapon in 2.

Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Reported-by: Weijie Yang <weijie.yang.kh@gmail.com>
Cc: Bob Liu <bob.liu@oracle.com>
Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Cc: Shaohua Li <shli@fusionio.com>
Cc: Minchan Kim <minchan@kernel.org>
Acked-by: Hugh Dickins <hughd@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
1 parent fad1a86
History
Tip revision: 5b808a2300a5ac45f4798ebfac8b367e98a4b692 authored by Krzysztof Kozlowski on 16 October 2013, 20:47:06 UTC
swap: fix set_blocksize race during swapon/swapoff
Tip revision: 5b808a2
File Mode Size
Kconfig -rw-r--r-- 18.7 KB
Kconfig.debug -rw-r--r-- 1015 bytes
Makefile -rw-r--r-- 2.0 KB
backing-dev.c -rw-r--r-- 16.5 KB
balloon_compaction.c -rw-r--r-- 9.6 KB
bootmem.c -rw-r--r-- 20.8 KB
bounce.c -rw-r--r-- 6.4 KB
cleancache.c -rw-r--r-- 12.7 KB
compaction.c -rw-r--r-- 32.5 KB
debug-pagealloc.c -rw-r--r-- 2.1 KB
dmapool.c -rw-r--r-- 13.1 KB
fadvise.c -rw-r--r-- 3.6 KB
failslab.c -rw-r--r-- 1.3 KB
filemap.c -rw-r--r-- 67.7 KB
filemap_xip.c -rw-r--r-- 11.3 KB
fremap.c -rw-r--r-- 6.7 KB
frontswap.c -rw-r--r-- 13.5 KB
highmem.c -rw-r--r-- 9.9 KB
huge_memory.c -rw-r--r-- 73.4 KB
hugetlb.c -rw-r--r-- 92.3 KB
hugetlb_cgroup.c -rw-r--r-- 10.4 KB
hwpoison-inject.c -rw-r--r-- 3.3 KB
init-mm.c -rw-r--r-- 619 bytes
internal.h -rw-r--r-- 11.2 KB
interval_tree.c -rw-r--r-- 3.2 KB
kmemcheck.c -rw-r--r-- 2.8 KB
kmemleak-test.c -rw-r--r-- 3.3 KB
kmemleak.c -rw-r--r-- 52.4 KB
ksm.c -rw-r--r-- 65.8 KB
list_lru.c -rw-r--r-- 3.1 KB
maccess.c -rw-r--r-- 1.6 KB
madvise.c -rw-r--r-- 14.2 KB
memblock.c -rw-r--r-- 30.1 KB
memcontrol.c -rw-r--r-- 186.4 KB
memory-failure.c -rw-r--r-- 45.8 KB
memory.c -rw-r--r-- 117.1 KB
memory_hotplug.c -rw-r--r-- 47.1 KB
mempolicy.c -rw-r--r-- 72.9 KB
mempool.c -rw-r--r-- 10.5 KB
migrate.c -rw-r--r-- 44.7 KB
mincore.c -rw-r--r-- 7.8 KB
mlock.c -rw-r--r-- 21.4 KB
mm_init.c -rw-r--r-- 5.0 KB
mmap.c -rw-r--r-- 85.9 KB
mmu_context.c -rw-r--r-- 1.2 KB
mmu_notifier.c -rw-r--r-- 9.5 KB
mmzone.c -rw-r--r-- 2.4 KB
mprotect.c -rw-r--r-- 10.3 KB
mremap.c -rw-r--r-- 14.9 KB
msync.c -rw-r--r-- 2.4 KB
nobootmem.c -rw-r--r-- 10.9 KB
nommu.c -rw-r--r-- 53.2 KB
oom_kill.c -rw-r--r-- 19.5 KB
page-writeback.c -rw-r--r-- 75.5 KB
page_alloc.c -rw-r--r-- 179.2 KB
page_cgroup.c -rw-r--r-- 11.9 KB
page_io.c -rw-r--r-- 8.9 KB
page_isolation.c -rw-r--r-- 7.5 KB
pagewalk.c -rw-r--r-- 5.9 KB
percpu-km.c -rw-r--r-- 2.8 KB
percpu-vm.c -rw-r--r-- 12.9 KB
percpu.c -rw-r--r-- 57.1 KB
pgtable-generic.c -rw-r--r-- 5.0 KB
process_vm_access.c -rw-r--r-- 13.2 KB
quicklist.c -rw-r--r-- 2.4 KB
readahead.c -rw-r--r-- 15.9 KB
rmap.c -rw-r--r-- 50.7 KB
shmem.c -rw-r--r-- 77.7 KB
slab.c -rw-r--r-- 114.2 KB
slab.h -rw-r--r-- 7.4 KB
slab_common.c -rw-r--r-- 15.4 KB
slob.c -rw-r--r-- 15.7 KB
slub.c -rw-r--r-- 125.4 KB
sparse-vmemmap.c -rw-r--r-- 5.9 KB
sparse.c -rw-r--r-- 21.0 KB
swap.c -rw-r--r-- 25.4 KB
swap_state.c -rw-r--r-- 11.4 KB
swapfile.c -rw-r--r-- 76.5 KB
truncate.c -rw-r--r-- 19.5 KB
util.c -rw-r--r-- 9.5 KB
vmalloc.c -rw-r--r-- 67.8 KB
vmpressure.c -rw-r--r-- 11.7 KB
vmscan.c -rw-r--r-- 106.8 KB
vmstat.c -rw-r--r-- 34.6 KB
zbud.c -rw-r--r-- 15.9 KB
zswap.c -rw-r--r-- 23.9 KB

back to top