[lkml]   [2018]   [May]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Patch in this message
Subject[PATCH 4.4 168/268] mm: fix races between address_space dereference and free in page_evicatable
4.4-stable review patch.  If anyone has any objections, please let me know.


From: Huang Ying <>

[ Upstream commit e92bb4dd9673945179b1fc738c9817dd91bfb629 ]

When page_mapping() is called and the mapping is dereferenced in
page_evicatable() through shrink_active_list(), it is possible for the
inode to be truncated and the embedded address space to be freed at the
same time. This may lead to the following race.


truncate(inode) shrink_active_list()
... page_evictable(page)
truncate_inode_page(mapping, page);
spin_lock_irqsave(&mapping->tree_lock, flags);
__delete_from_page_cache(page, NULL)
... mapping = page_mapping(page);
page->mapping = NULL;
spin_unlock_irqrestore(&mapping->tree_lock, flags);
page_cache_free_page(mapping, page)
if (put_page_testzero(page)) -> false
- inode now has no pages and can be freed including embedded address_space

test_bit(AS_UNEVICTABLE, &mapping->flags);
- we've dereferenced mapping which is potentially already free.

Similar race exists between swap cache freeing and page_evicatable()

The address_space in inode and swap cache will be freed after a RCU
grace period. So the races are fixed via enclosing the page_mapping()
and address_space usage in rcu_read_lock/unlock(). Some comments are
added in code to make it clear what is protected by the RCU read lock.

Signed-off-by: "Huang, Ying" <>
Reviewed-by: Jan Kara <>
Reviewed-by: Andrew Morton <>
Cc: Mel Gorman <>
Cc: Minchan Kim <>
Cc: "Huang, Ying" <>
Cc: Johannes Weiner <>
Cc: Michal Hocko <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
Signed-off-by: Sasha Levin <>
Signed-off-by: Greg Kroah-Hartman <>
mm/vmscan.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)

--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -3841,7 +3841,13 @@ int zone_reclaim(struct zone *zone, gfp_
int page_evictable(struct page *page)
- return !mapping_unevictable(page_mapping(page)) && !PageMlocked(page);
+ int ret;
+ /* Prevent address_space of inode and swap cache from being freed */
+ rcu_read_lock();
+ ret = !mapping_unevictable(page_mapping(page)) && !PageMlocked(page);
+ rcu_read_unlock();
+ return ret;


 \ /
  Last update: 2018-05-28 17:20    [W:0.635 / U:1.924 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site