mm: fix races between swapoff and flush dcache

Thanks to commit 4b3ef9daa4fc ("mm/swap: split swap cache into 64MB
trunks"), after swapoff the address_space associated with the swap
device will be freed.  So page_mapping() users which may touch the
address_space need some kind of mechanism to prevent the address_space
from being freed during accessing.

The dcache flushing functions (flush_dcache_page(), etc) in architecture
specific code may access the address_space of swap device for anonymous
pages in swap cache via page_mapping() function.  But in some cases
there are no mechanisms to prevent the swap device from being swapoff,
for example,

  CPU1					CPU2
  __get_user_pages()			swapoff()
    flush_dcache_page()
      mapping = page_mapping()
        ...				  exit_swap_address_space()
        ...				    kvfree(spaces)
        mapping_mapped(mapping)

The address space may be accessed after being freed.

But from cachetlb.txt and Russell King, flush_dcache_page() only care
about file cache pages, for anonymous pages, flush_anon_page() should be
used.  The implementation of flush_dcache_page() in all architectures
follows this too.  They will check whether page_mapping() is NULL and
whether mapping_mapped() is true to determine whether to flush the
dcache immediately.  And they will use interval tree (mapping->i_mmap)
to find all user space mappings.  While mapping_mapped() and
mapping->i_mmap isn't used by anonymous pages in swap cache at all.

So, to fix the race between swapoff and flush dcache, __page_mapping()
is add to return the address_space for file cache pages and NULL
otherwise.  All page_mapping() invoking in flush dcache functions are
replaced with page_mapping_file().

[akpm@linux-foundation.org: simplify page_mapping_file(), per Mike]
Link: http://lkml.kernel.org/r/20180305083634.15174-1-ying.huang@intel.com
Signed-off-by: "Huang, Ying" <ying.huang@intel.com>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Minchan Kim <minchan@kernel.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Mel Gorman <mgorman@techsingularity.net>
Cc: Dave Hansen <dave.hansen@intel.com>
Cc: Chen Liqin <liqin.linux@gmail.com>
Cc: Russell King <linux@armlinux.org.uk>
Cc: Yoshinori Sato <ysato@users.sourceforge.jp>
Cc: "James E.J. Bottomley" <jejb@parisc-linux.org>
Cc: Guan Xuetao <gxt@mprc.pku.edu.cn>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Chris Zankel <chris@zankel.net>
Cc: Vineet Gupta <vgupta@synopsys.com>
Cc: Ley Foon Tan <lftan@altera.com>
Cc: Ralf Baechle <ralf@linux-mips.org>
Cc: Andi Kleen <ak@linux.intel.com>
Cc: Mike Rapoport <rppt@linux.vnet.ibm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

diff --git a/arch/arc/mm/cache.c b/arch/arc/mm/cache.c
index 2072f3451e9c2127a076873113292a8ae2b5b9cb..9dbe645ee127ea10f831654f6a558a9645c71632 100644 (file)
--- a/arch/arc/mm/cache.c
+++ b/arch/arc/mm/cache.c
@@ -833,7 +833,7 @@ void flush_dcache_page(struct page *page)
        }
 
        /* don't handle anon pages here */
-       mapping = page_mapping(page);
+       mapping = page_mapping_file(page);
        if (!mapping)
                return;
 

diff --git a/arch/arm/mm/copypage-v4mc.c b/arch/arm/mm/copypage-v4mc.c
index 1267e64133b9251feea121d1170ed095b7734944..0224416cba3c8f323f04cf284fd2cd629e81c6ef 100644 (file)
--- a/arch/arm/mm/copypage-v4mc.c
+++ b/arch/arm/mm/copypage-v4mc.c
@@ -70,7 +70,7 @@ void v4_mc_copy_user_highpage(struct page *to, struct page *from,
        void *kto = kmap_atomic(to);
 
        if (!test_and_set_bit(PG_dcache_clean, &from->flags))
-               __flush_dcache_page(page_mapping(from), from);
+               __flush_dcache_page(page_mapping_file(from), from);
 
        raw_spin_lock(&minicache_lock);
 

diff --git a/arch/arm/mm/copypage-v6.c b/arch/arm/mm/copypage-v6.c
index 70423345da26ca93a6b8aa93eb5d0b842fa26345..a698e575e3216e9b2a99a519b6524dfd7a009ba3 100644 (file)
--- a/arch/arm/mm/copypage-v6.c
+++ b/arch/arm/mm/copypage-v6.c
@@ -76,7 +76,7 @@ static void v6_copy_user_highpage_aliasing(struct page *to,
        unsigned long kfrom, kto;
 
        if (!test_and_set_bit(PG_dcache_clean, &from->flags))
-               __flush_dcache_page(page_mapping(from), from);
+               __flush_dcache_page(page_mapping_file(from), from);
 
        /* FIXME: not highmem safe */
        discard_old_kernel_data(page_address(to));

diff --git a/arch/arm/mm/copypage-xscale.c b/arch/arm/mm/copypage-xscale.c
index 0fb85025344d936734f0ff695ed21c2626414560..97972379f4d6ad24ff28d1bef2ffbdbc5d295afb 100644 (file)
--- a/arch/arm/mm/copypage-xscale.c
+++ b/arch/arm/mm/copypage-xscale.c
@@ -90,7 +90,7 @@ void xscale_mc_copy_user_highpage(struct page *to, struct page *from,
        void *kto = kmap_atomic(to);
 
        if (!test_and_set_bit(PG_dcache_clean, &from->flags))
-               __flush_dcache_page(page_mapping(from), from);
+               __flush_dcache_page(page_mapping_file(from), from);
 
        raw_spin_lock(&minicache_lock);
 

diff --git a/arch/arm/mm/fault-armv.c b/arch/arm/mm/fault-armv.c
index d9e0d00a6699026a56606e3ae820c05ca5e183a3..4d75dae5ac96256447ebec5b0460831595dcfdbe 100644 (file)
--- a/arch/arm/mm/fault-armv.c
+++ b/arch/arm/mm/fault-armv.c
@@ -195,7 +195,7 @@ void update_mmu_cache(struct vm_area_struct *vma, unsigned long addr,
        if (page == ZERO_PAGE(0))
                return;
 
-       mapping = page_mapping(page);
+       mapping = page_mapping_file(page);
        if (!test_and_set_bit(PG_dcache_clean, &page->flags))
                __flush_dcache_page(mapping, page);
        if (mapping) {

diff --git a/arch/arm/mm/flush.c b/arch/arm/mm/flush.c
index f1e6190aa7eaedf5adacca20c09cb7c3702bee96..58469623b01581770129ea9dd1b16d9e3d2c1d48 100644 (file)
--- a/arch/arm/mm/flush.c
+++ b/arch/arm/mm/flush.c
@@ -285,7 +285,7 @@ void __sync_icache_dcache(pte_t pteval)
 
        page = pfn_to_page(pfn);
        if (cache_is_vipt_aliasing())
-               mapping = page_mapping(page);
+               mapping = page_mapping_file(page);
        else
                mapping = NULL;
 
@@ -333,7 +333,7 @@ void flush_dcache_page(struct page *page)
                return;
        }
 
-       mapping = page_mapping(page);
+       mapping = page_mapping_file(page);
 
        if (!cache_ops_need_broadcast() &&
            mapping && !page_mapcount(page))
@@ -363,7 +363,7 @@ void flush_kernel_dcache_page(struct page *page)
        if (cache_is_vivt() || cache_is_vipt_aliasing()) {
                struct address_space *mapping;
 
-               mapping = page_mapping(page);
+               mapping = page_mapping_file(page);
 
                if (!mapping || mapping_mapped(mapping)) {
                        void *addr;

diff --git a/arch/mips/mm/cache.c b/arch/mips/mm/cache.c
index 44ac64d5182761d547f5b14a29cd4c9b047d5129..0d3c656feba046508dd99bb403e7aaa6da85622e 100644 (file)
--- a/arch/mips/mm/cache.c
+++ b/arch/mips/mm/cache.c
@@ -86,7 +86,7 @@ SYSCALL_DEFINE3(cacheflush, unsigned long, addr, unsigned long, bytes,
 
 void __flush_dcache_page(struct page *page)
 {
-       struct address_space *mapping = page_mapping(page);
+       struct address_space *mapping = page_mapping_file(page);
        unsigned long addr;
 
        if (mapping && !mapping_mapped(mapping)) {

diff --git a/arch/nios2/mm/cacheflush.c b/arch/nios2/mm/cacheflush.c
index 87bf88ed04c6c0a13220e2b3588b7fedbb6145f3..506f6e1c86d55b72188f68235dd9f59a7ac3d725 100644 (file)
--- a/arch/nios2/mm/cacheflush.c
+++ b/arch/nios2/mm/cacheflush.c
@@ -180,7 +180,7 @@ void flush_dcache_page(struct page *page)
        if (page == ZERO_PAGE(0))
                return;
 
-       mapping = page_mapping(page);
+       mapping = page_mapping_file(page);
 
        /* Flush this page if there are aliases. */
        if (mapping && !mapping_mapped(mapping)) {
@@ -215,7 +215,7 @@ void update_mmu_cache(struct vm_area_struct *vma,
        if (page == ZERO_PAGE(0))
                return;
 
-       mapping = page_mapping(page);
+       mapping = page_mapping_file(page);
        if (!test_and_set_bit(PG_dcache_clean, &page->flags))
                __flush_dcache_page(mapping, page);
 

diff --git a/arch/parisc/kernel/cache.c b/arch/parisc/kernel/cache.c
index e3b45546d589b4e8ec3410d8229a3049bf7b062f..a99da95fc9fde89fc599e65868ae1bc5170777dc 100644 (file)
--- a/arch/parisc/kernel/cache.c
+++ b/arch/parisc/kernel/cache.c
@@ -88,7 +88,8 @@ update_mmu_cache(struct vm_area_struct *vma, unsigned long address, pte_t *ptep)
                return;
 
        page = pfn_to_page(pfn);
-       if (page_mapping(page) && test_bit(PG_dcache_dirty, &page->flags)) {
+       if (page_mapping_file(page) &&
+           test_bit(PG_dcache_dirty, &page->flags)) {
                flush_kernel_dcache_page_addr(pfn_va(pfn));
                clear_bit(PG_dcache_dirty, &page->flags);
        } else if (parisc_requires_coherency())
@@ -304,7 +305,7 @@ __flush_cache_page(struct vm_area_struct *vma, unsigned long vmaddr,
 
 void flush_dcache_page(struct page *page)
 {
-       struct address_space *mapping = page_mapping(page);
+       struct address_space *mapping = page_mapping_file(page);
        struct vm_area_struct *mpnt;
        unsigned long offset;
        unsigned long addr, old_addr = 0;

diff --git a/arch/sh/mm/cache-sh4.c b/arch/sh/mm/cache-sh4.c
index 58aaa4f33b8129b8dd7e8118ec2691478cf79757..eee911422cf9eb2907c03e753006f509bcd76a74 100644 (file)
--- a/arch/sh/mm/cache-sh4.c
+++ b/arch/sh/mm/cache-sh4.c
@@ -112,7 +112,7 @@ static void sh4_flush_dcache_page(void *arg)
        struct page *page = arg;
        unsigned long addr = (unsigned long)page_address(page);
 #ifndef CONFIG_SMP
-       struct address_space *mapping = page_mapping(page);
+       struct address_space *mapping = page_mapping_file(page);
 
        if (mapping && !mapping_mapped(mapping))
                clear_bit(PG_dcache_clean, &page->flags);

diff --git a/arch/sh/mm/cache-sh7705.c b/arch/sh/mm/cache-sh7705.c
index 6cd2aa395817a34e5aacbdacd9c83605a9593f79..ed25eba806678091ffc169366fa8402d46209db2 100644 (file)
--- a/arch/sh/mm/cache-sh7705.c
+++ b/arch/sh/mm/cache-sh7705.c
@@ -136,7 +136,7 @@ static void __flush_dcache_page(unsigned long phys)
 static void sh7705_flush_dcache_page(void *arg)
 {
        struct page *page = arg;
-       struct address_space *mapping = page_mapping(page);
+       struct address_space *mapping = page_mapping_file(page);
 
        if (mapping && !mapping_mapped(mapping))
                clear_bit(PG_dcache_clean, &page->flags);

diff --git a/arch/sparc/kernel/smp_64.c b/arch/sparc/kernel/smp_64.c
index c50182cd2f64684de47d7408c122677430137be7..d3ea1f3c06a003ae185b4d2b7bf9af552f62d34f 100644 (file)
--- a/arch/sparc/kernel/smp_64.c
+++ b/arch/sparc/kernel/smp_64.c
@@ -929,9 +929,9 @@ static inline void __local_flush_dcache_page(struct page *page)
 #ifdef DCACHE_ALIASING_POSSIBLE
        __flush_dcache_page(page_address(page),
                            ((tlb_type == spitfire) &&
-                            page_mapping(page) != NULL));
+                            page_mapping_file(page) != NULL));
 #else
-       if (page_mapping(page) != NULL &&
+       if (page_mapping_file(page) != NULL &&
            tlb_type == spitfire)
                __flush_icache_page(__pa(page_address(page)));
 #endif
@@ -958,7 +958,7 @@ void smp_flush_dcache_page_impl(struct page *page, int cpu)
 
                if (tlb_type == spitfire) {
                        data0 = ((u64)&xcall_flush_dcache_page_spitfire);
-                       if (page_mapping(page) != NULL)
+                       if (page_mapping_file(page) != NULL)
                                data0 |= ((u64)1 << 32);
                } else if (tlb_type == cheetah || tlb_type == cheetah_plus) {
 #ifdef DCACHE_ALIASING_POSSIBLE
@@ -994,7 +994,7 @@ void flush_dcache_page_all(struct mm_struct *mm, struct page *page)
        pg_addr = page_address(page);
        if (tlb_type == spitfire) {
                data0 = ((u64)&xcall_flush_dcache_page_spitfire);
-               if (page_mapping(page) != NULL)
+               if (page_mapping_file(page) != NULL)
                        data0 |= ((u64)1 << 32);
        } else if (tlb_type == cheetah || tlb_type == cheetah_plus) {
 #ifdef DCACHE_ALIASING_POSSIBLE

diff --git a/arch/sparc/mm/init_64.c b/arch/sparc/mm/init_64.c
index cb9ebac6663f3d45ddbd69c32718cc60e06c2c25..8aeb1aabe76e04ce694318e87ccd154f931c8d99 100644 (file)
--- a/arch/sparc/mm/init_64.c
+++ b/arch/sparc/mm/init_64.c
@@ -206,9 +206,9 @@ inline void flush_dcache_page_impl(struct page *page)
 #ifdef DCACHE_ALIASING_POSSIBLE
        __flush_dcache_page(page_address(page),
                            ((tlb_type == spitfire) &&
-                            page_mapping(page) != NULL));
+                            page_mapping_file(page) != NULL));
 #else
-       if (page_mapping(page) != NULL &&
+       if (page_mapping_file(page) != NULL &&
            tlb_type == spitfire)
                __flush_icache_page(__pa(page_address(page)));
 #endif
@@ -490,7 +490,7 @@ void flush_dcache_page(struct page *page)
 
        this_cpu = get_cpu();
 
-       mapping = page_mapping(page);
+       mapping = page_mapping_file(page);
        if (mapping && !mapping_mapped(mapping)) {
                int dirty = test_bit(PG_dcache_dirty, &page->flags);
                if (dirty) {

diff --git a/arch/sparc/mm/tlb.c b/arch/sparc/mm/tlb.c
index b5cfab7116514814cd244fb89f485d75c104e946..3d72d2deb13bb980484c4b491da8200c0c7c43c1 100644 (file)
--- a/arch/sparc/mm/tlb.c
+++ b/arch/sparc/mm/tlb.c
@@ -128,7 +128,7 @@ void tlb_batch_add(struct mm_struct *mm, unsigned long vaddr,
                        goto no_cache_flush;
 
                /* A real file page? */
-               mapping = page_mapping(page);
+               mapping = page_mapping_file(page);
                if (!mapping)
                        goto no_cache_flush;
 

diff --git a/arch/unicore32/mm/flush.c b/arch/unicore32/mm/flush.c
index 6d4c096ffa2a8bb59aaf7d1635cc70d7276b0361..74f4d636df2d05cb0fbc623d0d3ed199a48c7a02 100644 (file)
--- a/arch/unicore32/mm/flush.c
+++ b/arch/unicore32/mm/flush.c
@@ -83,7 +83,7 @@ void flush_dcache_page(struct page *page)
        if (page == ZERO_PAGE(0))
                return;
 
-       mapping = page_mapping(page);
+       mapping = page_mapping_file(page);
 
        if (mapping && !mapping_mapped(mapping))
                clear_bit(PG_dcache_clean, &page->flags);

diff --git a/arch/unicore32/mm/mmu.c b/arch/unicore32/mm/mmu.c
index 4f5a532bee13123b08cbc775116fe4b92291973c..0c94b7b4514dced7d28d3151a6f02081c7efc200 100644 (file)
--- a/arch/unicore32/mm/mmu.c
+++ b/arch/unicore32/mm/mmu.c
@@ -503,7 +503,7 @@ void update_mmu_cache(struct vm_area_struct *vma, unsigned long addr,
        if (page == ZERO_PAGE(0))
                return;
 
-       mapping = page_mapping(page);
+       mapping = page_mapping_file(page);
        if (!test_and_set_bit(PG_dcache_clean, &page->flags))
                __flush_dcache_page(mapping, page);
        if (mapping)

diff --git a/arch/xtensa/mm/cache.c b/arch/xtensa/mm/cache.c
index 57dc231a0709d6b30a9d509ff483c14be70c323a..9220dcde7520cd79e0a7924d8f130a62a0b0866d 100644 (file)
--- a/arch/xtensa/mm/cache.c
+++ b/arch/xtensa/mm/cache.c
@@ -127,7 +127,7 @@ EXPORT_SYMBOL(copy_user_highpage);
 
 void flush_dcache_page(struct page *page)
 {
-       struct address_space *mapping = page_mapping(page);
+       struct address_space *mapping = page_mapping_file(page);
 
        /*
         * If we have a mapping but the page is not mapped to user-space

diff --git a/include/linux/mm.h b/include/linux/mm.h
index 40fca1b2b6a17b62a8ae27849f5e92ef079eef8e..88d82ba29d724446c6d6548b4713019847ce2883 100644 (file)
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -1155,6 +1155,7 @@ static inline pgoff_t page_index(struct page *page)
 
 bool page_mapped(struct page *page);
 struct address_space *page_mapping(struct page *page);
+struct address_space *page_mapping_file(struct page *page);
 
 /*
  * Return true only if the page has been allocated with

diff --git a/mm/util.c b/mm/util.c
index c1250501364fbdb319420d2ba3cd1fc8b63d8c37..029fc2f3b395054a08595dca3ec38bae63877261 100644 (file)
--- a/mm/util.c
+++ b/mm/util.c
@@ -515,6 +515,16 @@ struct address_space *page_mapping(struct page *page)
 }
 EXPORT_SYMBOL(page_mapping);
 
+/*
+ * For file cache pages, return the address_space, otherwise return NULL
+ */
+struct address_space *page_mapping_file(struct page *page)
+{
+       if (unlikely(PageSwapCache(page)))
+               return NULL;
+       return page_mapping(page);
+}
+
 /* Slow path of page_mapcount() for compound pages */
 int __page_mapcount(struct page *page)
 {