Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ed493cfe authored by DerTeufel's avatar DerTeufel Committed by Samuel Pascua
Browse files

mm/swap: fix race on swap_info reuse between swapoff and swapon DateThu, 09 Jan 2014 13:39:55 +0800 



swapoff clear swap_info's SWP_USED flag prematurely and free its resources
after that. A concurrent swapon will reuse this swap_info while its previous
resources are not cleared completely.

These late freed resources are:
- p->percpu_cluster
- swap_cgroup_ctrl[type]
- block_device setting
- inode->i_flags &= ~S_SWAPFILE

This patch clear SWP_USED flag after all its resources freed, so that swapon
can reuse this swap_info by alloc_swap_info() safely.

Change-Id: I64609c8a1d266dac812eb81e73f3bb338a97290f
Signed-off-by: default avatarWeijie Yang <weijie.yang@samsung.com>
Signed-off-by: default avatarPaul Reioux <reioux@gmail.com>
parent ec54361e

mm/swapfile.c

+9 −1
Original line number Diff line number Diff line
@@ -1673,7 +1673,6 @@ SYSCALL_DEFINE1(swapoff, const char __user *, specialfile) 
	p->max = 0;

	swap_map = p->swap_map;

	p->swap_map = NULL;

	p->flags = 0;

	spin_unlock(&swap_lock);

	mutex_unlock(&swapon_mutex);

	vfree(swap_map);
@@ -1691,6 +1690,15 @@ SYSCALL_DEFINE1(swapoff, const char __user *, specialfile) 
		mutex_unlock(&inode->i_mutex);

	}

	filp_close(swap_file, NULL);



  	/*

  	* clear SWP_USED flag after all resources freed

  	* so that swapon can reuse this swap_info in alloc_swap_info() safely

  	* it is ok to not hold p->lock after we cleared its SWP_WRITEOK

  	*/

  	spin_lock(&swap_lock);

  	p->flags = 0;

  	spin_unlock(&swap_lock);

	err = 0;

	atomic_inc(&proc_poll_event);

	wake_up_interruptible(&proc_poll_wait);