You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Hugh Dickins 31c4a3d3a0 mm: further fix swapin race condition ... Commit 4969c1192d ("mm: fix swapin race condition") is now agreed to be incomplete. There's a race, not very much less likely than the original race envisaged, in which it is further necessary to check that the swapcache page's swap has not changed. Here's the reasoning: cast in terms of reuse_swap_page(), but probably could be reformulated to rely on try_to_free_swap() instead, or on swapoff+swapon. A, faults into do_swap_page(): does page1 = lookup_swap_cache(swap1) and comes through the lock_page(page1). B, a racing thread of the same process, faults on the same address: does page1 = lookup_swap_cache(swap1) and now waits in lock_page(page1), but for whatever reason is unlucky not to get the lock any time soon. A carries on through do_swap_page(), a write fault, but cannot reuse the swap page1 (another reference to swap1). Unlocks the page1 (but B doesn't get it yet), does COW in do_wp_page(), page2 now in that pte. C, perhaps the parent of A+B, comes in and write faults the same swap page1 into its mm, reuse_swap_page() succeeds this time, swap1 is freed. kswapd comes in after some time (B still unlucky) and swaps out some pages from A+B and C: it allocates the original swap1 to page2 in A+B, and some other swap2 to the original page1 now in C. But does not immediately free page1 (actually it couldn't: B holds a reference), leaving it in swap cache for now. B at last gets the lock on page1, hooray! Is PageSwapCache(page1)? Yes. Is pte_same(*page_table, orig_pte)? Yes, because page2 has now been given the swap1 which page1 used to have. So B proceeds to insert page1 into A+B's page_table, though its content now belongs to C, quite different from what A wrote there. B ought to have checked that page1's swap was still swap1. Signed-off-by: Hugh Dickins <hughd@google.com> Reviewed-by: Rik van Riel <riel@redhat.com> Cc: stable@kernel.org Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>		15 years ago
..
Kconfig	mm: avoid warning when COMPACTION is selected	15 years ago
Kconfig.debug	…
Makefile	lmb: rename to memblock	15 years ago
backing-dev.c	writeback: do not lose wakeup events when forking bdi threads	15 years ago
bootmem.c	x86,nobootmem: make alloc_bootmem_node fall back to other node when 32bit numa is used	15 years ago
bounce.c	bounce: call flush_dcache_page() after bounce_copy_vec()	15 years ago
compaction.c	mm: compaction: handle active and inactive fairly in too_many_isolated	15 years ago
debug-pagealloc.c	…
dmapool.c	…
fadvise.c	readahead: introduce FMODE_RANDOM for POSIX_FADV_RANDOM	15 years ago
failslab.c	include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h	15 years ago
filemap.c	gcc-4.6: mm: fix unused but set warnings	15 years ago
filemap_xip.c	include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h	15 years ago
fremap.c	mm: clean up mm_counter	15 years ago
highmem.c	mm,kdb,kgdb: Add a debug reference for the kdb kmap usage	15 years ago
hugetlb.c	Merge branch 'hwpoison' of git://git.kernel.org/pub/scm/linux/kernel/git/ak/linux-mce-2.6	15 years ago
hwpoison-inject.c	HWPOISON, hugetlb: support hwpoison injection for hugepage	15 years ago
init-mm.c	mm: provide init_mm mm_context initializer	15 years ago
internal.h	…
kmemcheck.c	kmemcheck: Fix build errors due to missing slab.h	15 years ago
kmemleak-test.c	…
kmemleak.c	kmemleak: Fix typo in the comment	15 years ago
ksm.c	mm: fix swapin race condition	15 years ago
maccess.c	…
madvise.c	…
memblock.c	memblock: Fix memblock_is_region_reserved() to return a boolean	15 years ago
memcontrol.c	memcg: convert to use zone_to_nid() from bare zone->zone_pgdat->node_id	15 years ago
memory-failure.c	Merge branch 'hwpoison' of git://git.kernel.org/pub/scm/linux/kernel/git/ak/linux-mce-2.6	15 years ago
memory.c	mm: further fix swapin race condition	15 years ago
memory_hotplug.c	memory hotplug: fix next block calculation in is_removable	15 years ago
mempolicy.c	mempolicy: reduce stack size of migrate_pages()	15 years ago
mempool.c	…
migrate.c	mm: extend KSM refcounts to the anon_vma root	15 years ago
mincore.c	mincore: do nested page table walks	15 years ago
mlock.c	mm: Move vma_stack_continue into mm.h	15 years ago
mm_init.c	…
mmap.c	guard page for stacks that grow upwards	15 years ago
mmu_context.c	exit: fix oops in sync_mm_rss	15 years ago
mmu_notifier.c	include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h	15 years ago
mmzone.c	mm: page allocator: calculate a better estimate of NR_FREE_PAGES when memory is low and kswapd is awake	15 years ago
mprotect.c	include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h	15 years ago
mremap.c	include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h	15 years ago
msync.c	sanitize vfs_fsync calling conventions	15 years ago
nommu.c	mm: make the vma list be doubly linked	15 years ago
oom_kill.c	oom: __task_cred() need rcu_read_lock()	15 years ago
page-writeback.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client	15 years ago
page_alloc.c	mm: page allocator: drain per-cpu lists after direct reclaim allocation fails	15 years ago
page_cgroup.c	kmemleak: Annotate false positive in init_section_page_cgroup()	15 years ago
page_io.c	block: unify flags for struct bio and struct request	15 years ago
page_isolation.c	…
pagewalk.c	pagemap: fix pfn calculation for hugepage	15 years ago
percpu-km.c	percpu: implement kernel memory based chunk allocation	15 years ago
percpu-vm.c	percpu: move vmalloc based chunk management into percpu-vm.c	15 years ago
percpu.c	percpu: fix a mismatch between code and comment	15 years ago
percpu_up.c	percpu: add __percpu notations to UP allocator	15 years ago
prio_tree.c	…
quicklist.c	include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h	15 years ago
readahead.c	readahead.c: fix comment	15 years ago
rmap.c	mm: fix hang on anon_vma->root->lock	15 years ago
shmem.c	shmem: put_super must percpu_counter_destroy	15 years ago
slab.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/penberg/slab-2.6	15 years ago
slob.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/penberg/slab-2.6	15 years ago
slub.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/penberg/slab-2.6	15 years ago
sparse-vmemmap.c	include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h	15 years ago
sparse.c	sparsemem: on no vmemmap path put mem_map on node high too	15 years ago
swap.c	mm: export lru_cache_add_*() to modules	15 years ago
swap_state.c	include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h	15 years ago
swapfile.c	swap: discard while swapping only if SWAP_FLAG_DISCARD	15 years ago
thrash.c	…
truncate.c	check ATTR_SIZE contraints in inode_change_ok	15 years ago
util.c	mm: use memdup_user	15 years ago
vmalloc.c	Merge branch 'stable/xen-swiotlb-0.8.6' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen	15 years ago
vmscan.c	memcg: remove nid and zid argument from mem_cgroup_soft_limit_reclaim()	15 years ago
vmstat.c	mm: page allocator: calculate a better estimate of NR_FREE_PAGES when memory is low and kswapd is awake	15 years ago