Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
IronPort-SDR: Djkd01zS5ZCH+2c2EGsRs2AnrWiCBlFLiFLUPlohgmZ0lD0sAVC8wRhpLm3EQXgJktMtmTOHTt
 BHCKafYtiDBw==
IronPort-SDR: oZrfYiEFLYHlv33w1/1ygwjh5hfSEQi2PdpgjdsJ55B6ynmAGxF5Xsq+49kCowZkCbOsI1+dWM
 sAPTeRzemSmg==
From:   "Huang, Ying" <ying.huang@intel.com>
To:     Miaohe Lin <linmiaohe@huawei.com>
Cc:     Linux-MM <linux-mm@kvack.org>,
        linux-kernel <linux-kernel@vger.kernel.org>,
        Andrew Morton <akpm@linux-foundation.org>,
        Matthew Wilcox <willy@infradead.org>,
        Yu Zhao <yuzhao@google.com>,
        Shakeel Butt <shakeelb@google.com>,
        Alex Shi <alex.shi@linux.alibaba.com>,
        Minchan Kim <minchan@kernel.org>
Subject: Re: [Question] Is there a race window between swapoff vs
 synchronous swap_readpage
References: <364d7ce9-ccb7-fa04-7067-44a96be87060@huawei.com>
Date:   Tue, 30 Mar 2021 09:57:55 +0800
In-Reply-To: <364d7ce9-ccb7-fa04-7067-44a96be87060@huawei.com> (Miaohe Lin's
        message of "Mon, 29 Mar 2021 21:18:20 +0800")
Message-ID: <8735wdbdy4.fsf@yhuang6-desk1.ccr.corp.intel.com>
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/27.1 (gnu/linux)
MIME-Version: 1.0
Content-Type: text/plain; charset=ascii
Precedence: bulk

Hi, Miaohe,

Miaohe Lin <linmiaohe@huawei.com> writes:

> Hi all,
> I am investigating the swap code, and I found the below possible race window:
>
> CPU 1							CPU 2
> -----							-----
> do_swap_page
>   skip swapcache case (synchronous swap_readpage)
>     alloc_page_vma
> 							swapoff
> 							  release swap_file, bdev, or ...
>       swap_readpage
> 	check sis->flags is ok
> 	  access swap_file, bdev or ...[oops!]
> 							    si->flags = 0
>
> The swapcache case is ok because swapoff will wait on the page_lock of swapcache page.
> Is this will really happen or Am I miss something ?
> Any reply would be really grateful. Thanks! :)

This appears possible.  Even for swapcache case, we can't guarantee the
swap entry gotten from the page table is always valid too.  The
underlying swap device can be swapped off at the same time.  So we use
get/put_swap_device() for that.  Maybe we need similar stuff here.

Best Regards,
Huang, Ying