The patch titled
Subject: mm: fix data corruption caused by lazyfree page
has been added to the -mm tree. Its filename is
mm-fix-data-corruption-caused-by-lazyfree-page.patch
This patch should soon appear at
http://ozlabs.org/~akpm/mmots/broken-out/mm-fix-data-corruption-caused-by-lazyfree-page.patch
and later at
http://ozlabs.org/~akpm/mmotm/broken-out/mm-fix-data-corruption-caused-by-lazyfree-page.patch
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/SubmitChecklist when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Shaohua Li <shli@xxxxxx>
Subject: mm: fix data corruption caused by lazyfree page
MADV_FREE clears pte dirty bit and then marks the page lazyfree (clear
SwapBacked). There is no lock to prevent the page is added to swap cache
between these two steps by page reclaim. If page reclaim finds such page,
it will simply add the page to swap cache without pageout the page to swap
because the page is marked as clean. Next time, page fault will read data
from the swap slot which doesn't have the original data, so we have a data
corruption. To fix issue, we mark the page dirty and pageout the page.
However, we shouldn't dirty all pages which is clean and in swap cache.
swapin page is swap cache and clean too. So we only dirty page which is
added into swap cache in page reclaim, which shouldn't be swapin page. As
Minchan suggested, simply dirty the page in add_to_swap can do the job.
Fixes: 802a3a92ad7a ("mm: reclaim MADV_FREE pages")
Link: http://lkml.kernel.org/r/08c84256b007bf3f63c91d94383bd9eb6fee2daa.1506446061.git.shli@xxxxxx
Signed-off-by: Shaohua Li <shli@xxxxxx>
Reported-by: Artem Savkov <asavkov@xxxxxxxxxx>
Acked-by: Michal Hocko <mhocko@xxxxxxxx>
Cc: Johannes Weiner <hannes@xxxxxxxxxxx>
Cc: Hillf Danton <hillf.zj@xxxxxxxxxxxxxxx>
Cc: Minchan Kim <minchan@xxxxxxxxxx>
Cc: Hugh Dickins <hughd@xxxxxxxxxx>
Cc: Rik van Riel <riel@xxxxxxxxxx>
Cc: Mel Gorman <mgorman@xxxxxxxxxxxxxxxxxxx>
Cc: <stable@xxxxxxxxxxxxxxx> [4.12+]
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---
mm/swap_state.c | 11 +++++++++++
1 file changed, 11 insertions(+)
diff -puN mm/swap_state.c~mm-fix-data-corruption-caused-by-lazyfree-page mm/swap_state.c
--- a/mm/swap_state.c~mm-fix-data-corruption-caused-by-lazyfree-page
+++ a/mm/swap_state.c
@@ -242,6 +242,17 @@ int add_to_swap(struct page *page)
* clear SWAP_HAS_CACHE flag.
*/
goto fail;
+ /*
+ * Normally the page will be dirtied in unmap because its pte should be
+ * dirty. A special case is MADV_FREE page. The page'e pte could have
+ * dirty bit cleared but the page's SwapBacked bit is still set because
+ * clearing the dirty bit and SwapBacked bit has no lock protected. For
+ * such page, unmap will not set dirty bit for it, so page reclaim will
+ * not write the page out. This can cause data corruption when the page
+ * is swap in later. Always setting the dirty bit for the page solves
+ * the problem.
+ */
+ set_page_dirty(page);
return 1;
_
Patches currently in -mm which might be from shli@xxxxxx are
mm-avoid-marking-swap-cached-page-as-lazyfree.patch
mm-fix-data-corruption-caused-by-lazyfree-page.patch