Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 87518530 authored by Oleg Nesterov's avatar Oleg Nesterov Committed by Linus Torvalds
Browse files

swap_readpage(): avoid blk_wake_io_task() if !synchronous 

swap_readpage() sets waiter = bio->bi_private even if synchronous = F,
this means that the caller can get the spurious wakeup after return.

This can be fatal if blk_wake_io_task() does
set_current_state(TASK_RUNNING) after the caller does
set_special_state(), in the worst case the kernel can crash in
do_task_dead().

Link: http://lkml.kernel.org/r/20190704160301.GA5956@redhat.com


Fixes: 0619317f ("block: add polled wakeup task helper")
Signed-off-by: default avatarOleg Nesterov <oleg@redhat.com>
Reported-by: default avatarQian Cai <cai@lca.pw>
Acked-by: default avatarHugh Dickins <hughd@google.com>
Reviewed-by: default avatarJens Axboe <axboe@kernel.dk>
Cc: <stable@vger.kernel.org>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent eef778c9

mm/page_io.c

+8 −5
Original line number Diff line number Diff line
@@ -137,9 +137,11 @@ static void end_swap_bio_read(struct bio *bio) 
	unlock_page(page);

	WRITE_ONCE(bio->bi_private, NULL);

	bio_put(bio);

	if (waiter) {

		blk_wake_io_task(waiter);

		put_task_struct(waiter);

	}

}



int generic_swapfile_activate(struct swap_info_struct *sis,

				struct file *swap_file,
@@ -395,11 +397,12 @@ int swap_readpage(struct page *page, bool synchronous) 
	 * Keep this task valid during swap readpage because the oom killer may

	 * attempt to access it in the page fault retry time check.

	 */

	get_task_struct(current);

	bio->bi_private = current;

	bio_set_op_attrs(bio, REQ_OP_READ, 0);

	if (synchronous)

	if (synchronous) {

		bio->bi_opf |= REQ_HIPRI;

		get_task_struct(current);

		bio->bi_private = current;

	}

	count_vm_event(PSWPIN);

	bio_get(bio);

	qc = submit_bio(bio);