On Wed, Aug 29, 2012 at 04:58:45PM -0500, Seth Jennings wrote: > This patch fixes a race condition that results in memory > corruption when using cleancache. > > The race exists between the zcache shrinker handler, > shrink_zcache_memory() and cleancache_get_page(). > > In most cases, the shrinker will both evict a zbpg > from its buddy list and flush it from tmem before a > cleancache_get_page() occurs on that page. A subsequent > cleancache_get_page() will fail in the tmem layer. > > In the rare case that two occur together and the > cleancache_get_page() path gets through the tmem > layer before the shrinker path can flush tmem, > zbud_decompress() does a check to see if the zbpg is a > "zombie", i.e. not on a buddy list, which means the shrinker > is in the process of reclaiming it. If the zbpg is a zombie, > zbud_decompress() returns -EINVAL. > > However, this return code is being ignored by the caller, > zcache_pampd_get_data_and_free(), which results in the > caller of cleancache_get_page() thinking that the page has > been properly retrieved when it has not. > > This patch modifies zcache_pampd_get_data_and_free() to > convey the failure up the stack so that the caller of > cleancache_get_page() knows the page retrieval failed. > > --- > Based on v3.6-rc3. > > This needs to be applied to stable trees as well. > zcache-main.c was named zcache.c before v3.1, so > I'm not sure how you want to handle trees earlier > than that. > > Signed-off-by: Seth Jennings <sjenning@xxxxxxxxxxxxxxxxxx> Reviewed-by: Minchan Kim <minchan@xxxxxxxxxx> Thanks! -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@xxxxxxxxx. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: <a href=mailto:"dont@xxxxxxxxx";> email@xxxxxxxxx </a>