• Qian Cai's avatar
    mm/vmscan.c: fix data races using kswapd_classzone_idx · 5644e1fb
    Qian Cai authored
    pgdat->kswapd_classzone_idx could be accessed concurrently in
    wakeup_kswapd().  Plain writes and reads without any lock protection
    result in data races.  Fix them by adding a pair of READ|WRITE_ONCE() as
    well as saving a branch (compilers might well optimize the original code
    in an unintentional way anyway).  While at it, also take care of
    pgdat->kswapd_order and non-kswapd threads in allow_direct_reclaim().  The
    data races were reported by KCSAN,
    
     BUG: KCSAN: data-race in wakeup_kswapd / wakeup_kswapd
    
     write to 0xffff9f427ffff2dc of 4 bytes by task 7454 on cpu 13:
      wakeup_kswapd+0xf1/0x400
      wakeup_kswapd at mm/vmscan.c:3967
      wake_all_kswapds+0x59/0xc0
      wake_all_kswapds at mm/page_alloc.c:4241
      __alloc_pages_slowpath+0xdcc/0x1290
      __alloc_pages_slowpath at mm/page_alloc.c:4512
      __alloc_pages_nodemask+0x3bb/0x450
      alloc_pages_vma+0x8a/0x2c0
      do_anonymous_page+0x16e/0x6f0
      __handle_mm_fault+0xcd5/0xd40
      handle_mm_fault+0xfc/0x2f0
      do_page_fault+0x263/0x6f9
      page_fault+0x34/0x40
    
     1 lock held by mtest01/7454:
      #0: ffff9f425afe8808 (&mm->mmap_sem#2){++++}, at:
     do_page_fault+0x143/0x6f9
     do_user_addr_fault at arch/x86/mm/fault.c:1405
     (inlined by) do_page_fault at arch/x86/mm/fault.c:1539
     irq event stamp: 6944085
     count_memcg_event_mm+0x1a6/0x270
     count_memcg_event_mm+0x119/0x270
     __do_softirq+0x34c/0x57c
     irq_exit+0xa2/0xc0
    
     read to 0xffff9f427ffff2dc of 4 bytes by task 7472 on cpu 38:
      wakeup_kswapd+0xc8/0x400
      wake_all_kswapds+0x59/0xc0
      __alloc_pages_slowpath+0xdcc/0x1290
      __alloc_pages_nodemask+0x3bb/0x450
      alloc_pages_vma+0x8a/0x2c0
      do_anonymous_page+0x16e/0x6f0
      __handle_mm_fault+0xcd5/0xd40
      handle_mm_fault+0xfc/0x2f0
      do_page_fault+0x263/0x6f9
      page_fault+0x34/0x40
    
     1 lock held by mtest01/7472:
      #0: ffff9f425a9ac148 (&mm->mmap_sem#2){++++}, at:
     do_page_fault+0x143/0x6f9
     irq event stamp: 6793561
     count_memcg_event_mm+0x1a6/0x270
     count_memcg_event_mm+0x119/0x270
     __do_softirq+0x34c/0x57c
     irq_exit+0xa2/0xc0
    
     BUG: KCSAN: data-race in kswapd / wakeup_kswapd
    
     write to 0xffff90973ffff2dc of 4 bytes by task 820 on cpu 6:
      kswapd+0x27c/0x8d0
      kthread+0x1e0/0x200
      ret_from_fork+0x27/0x50
    
     read to 0xffff90973ffff2dc of 4 bytes by task 6299 on cpu 0:
      wakeup_kswapd+0xf3/0x450
      wake_all_kswapds+0x59/0xc0
      __alloc_pages_slowpath+0xdcc/0x1290
      __alloc_pages_nodemask+0x3bb/0x450
      alloc_pages_vma+0x8a/0x2c0
      do_anonymous_page+0x170/0x700
      __handle_mm_fault+0xc9f/0xd00
      handle_mm_fault+0xfc/0x2f0
      do_page_fault+0x263/0x6f9
      page_fault+0x34/0x40
    Signed-off-by: default avatarQian Cai <cai@lca.pw>
    Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
    Reviewed-by: default avatarAndrew Morton <akpm@linux-foundation.org>
    Cc: Marco Elver <elver@google.com>
    Cc: Matthew Wilcox <willy@infradead.org>
    Link: http://lkml.kernel.org/r/1582749472-5171-1-git-send-email-cai@lca.pwSigned-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    5644e1fb
vmscan.c 123 KB