[lkml]   [2020]   [Sep]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [PATCH] mm: swapfile: avoid split_swap_cluster() NULL pointer dereference
Rafael Aquini <> writes:

>> If there's a race, we should fix the race. But the code path for
>> swapcache insertion is,
>> add_to_swap()
>> get_swap_page() /* Return if fails to allocate */
>> add_to_swap_cache()
>> SetPageSwapCache()
>> While the code path to split THP is,
>> split_huge_page_to_list()
>> if PageSwapCache()
>> split_swap_cluster()
>> Both code paths are protected by the page lock. So there should be some
>> other reasons to trigger the bug.
> As mentioned above, no they seem to not be protected (at least, not the
> same page, depending on the case). While add_to_swap() will assure a
> page_lock on the compound head, split_huge_page_to_list() does not.

int split_huge_page_to_list(struct page *page, struct list_head *list)
struct page *head = compound_head(page);
struct pglist_data *pgdata = NODE_DATA(page_to_nid(head));
struct deferred_split *ds_queue = get_deferred_split_queue(head);
struct anon_vma *anon_vma = NULL;
struct address_space *mapping = NULL;
int count, mapcount, extra_pins, ret;
unsigned long flags;
pgoff_t end;

VM_BUG_ON_PAGE(is_huge_zero_page(head), head);
VM_BUG_ON_PAGE(!PageLocked(head), head);

I found there's page lock checking in split_huge_page_to_list().

Best Regards,
Huang, Ying

 \ /
  Last update: 2020-09-24 08:58    [W:0.101 / U:0.188 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site