From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id B4A0BC54E58 for ; Sat, 23 Mar 2024 10:55:44 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 0ABD46B008A; Sat, 23 Mar 2024 06:55:44 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 05A716B008C; Sat, 23 Mar 2024 06:55:43 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id E8B3B6B0092; Sat, 23 Mar 2024 06:55:43 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0012.hostedemail.com [216.40.44.12]) by kanga.kvack.org (Postfix) with ESMTP id D98F46B008A for ; Sat, 23 Mar 2024 06:55:43 -0400 (EDT) Received: from smtpin24.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay08.hostedemail.com (Postfix) with ESMTP id A6FEB1417C6 for ; Sat, 23 Mar 2024 10:55:43 +0000 (UTC) X-FDA: 81927998166.24.67F16E1 Received: from mail-vk1-f173.google.com (mail-vk1-f173.google.com [209.85.221.173]) by imf16.hostedemail.com (Postfix) with ESMTP id DC3EE180010 for ; Sat, 23 Mar 2024 10:55:41 +0000 (UTC) Authentication-Results: imf16.hostedemail.com; dkim=pass header.d=gmail.com header.s=20230601 header.b=edq6AF57; spf=pass (imf16.hostedemail.com: domain of 21cnbao@gmail.com designates 209.85.221.173 as permitted sender) smtp.mailfrom=21cnbao@gmail.com; dmarc=pass (policy=none) header.from=gmail.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1711191341; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=xeR9jyeeSFGixsQ60UvvrP66DhRiCJxbFbWHuFfTK8A=; b=UvIjlBKIaFEyEO/DtPvpaGvtD1tUzkenwftgrS7dl0GJykxNYSQmJKYboqTY7eHP9vKSRd ki1WvRU6Wpd202zqQuj1ji4rSq1F3DEGdh+hBqWUKY7oqs5AnvttdLLF/9wXbPet6ODzt4 S/RhvL7+o8fcdY6PKtBe7FdoC3l8Oyg= ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1711191341; a=rsa-sha256; cv=none; b=oKMyY2qYaJS+vQY7f15aH3joRn3EXHxDaOMrzN6OL47lRYSL2s1TQS5SoVoNj8navl+81d OXXizC7nqkMV5EEiT0xN08Cah5bSMnF/dqpt01q2H/2tvwzgmOIxOMPScY2u8mbfnWucvN RjxI0hCYEkG4FzUrt72nK/Kb40p7TpE= ARC-Authentication-Results: i=1; imf16.hostedemail.com; dkim=pass header.d=gmail.com header.s=20230601 header.b=edq6AF57; spf=pass (imf16.hostedemail.com: domain of 21cnbao@gmail.com designates 209.85.221.173 as permitted sender) smtp.mailfrom=21cnbao@gmail.com; dmarc=pass (policy=none) header.from=gmail.com Received: by mail-vk1-f173.google.com with SMTP id 71dfb90a1353d-4d43b3fc06cso1211701e0c.3 for ; Sat, 23 Mar 2024 03:55:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1711191341; x=1711796141; darn=kvack.org; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:from:to:cc:subject:date :message-id:reply-to; bh=xeR9jyeeSFGixsQ60UvvrP66DhRiCJxbFbWHuFfTK8A=; b=edq6AF57r7vh5FLGWWGZNwI8SHzSkNo+u+OfecHrCQjDiw0oLizb22ol+pPErwL1rP K9sLqTXbI8ALJvRp2jUlmDrxNIdsV/pP8ynQgorEXP5xOhZ43e6cwUGsJcEWnG0kE5YS adrDaGUalXZHI3tic7i61oGkRy4SkHZG0mGTg5eULb19cig8u2n+A+uc4kj7SXVduFme 2UTQ8mY4GDcZZ7RbvfWOaIjaeJlrsuHSjupHAN0ib07KuWBt4iK1jPk+bCM+X+6KjH2l dGqVm2eMgfl0lk9SCBxX/hDpMjjPaqqClL7+FZunShcljRH7ukhf6VKtqQjE59Vt6Vth l7Xg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1711191341; x=1711796141; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=xeR9jyeeSFGixsQ60UvvrP66DhRiCJxbFbWHuFfTK8A=; b=E73pttuJwRH+1mrfaR6l8h3J8Yud8E0ohhfo99hF/OqXTqU0GDgy5AXedqa8NCM60F gF9gG0BrEC3szmvllxFdVVTicXC6Q84EeoO51CTjSkEOaCsDPSVcWesNwRXx1/csW0FI KSYrJ6ETJURoNAkB8DPlfk6ZvzknPH1MBTzBbfKF5owjA5D6V4gPx95E0FmOu+ekDeZn j2d0vmlwYy0PzLT/liIGoqEXV+rOcaxNqnNaJ0PJeA8LmbcXvL50nR4dO8yCwYoRFufS HNKqFGaWoojmHcsVKNWXZadL8EA2tZSxsAKgHjhGyvCELB+gyr2L3STAu+ri3Jn1UKGi XIug== X-Forwarded-Encrypted: i=1; AJvYcCVJbXoTs8Pq4ZJ3fRhhsOjxF9HbO0nZHcYGHd304mroRTOxzAHFV7TI9sJ21iDO7P+IpjDbOHttdAf6iJJNU1SCKYc= X-Gm-Message-State: AOJu0Yxk8vgFDZ/FTGATlbSsXiMBb65XVEE6mxDWztkgC2ZSyvinX3s2 lCaF2BANFv61+FA7Dpygg6WItI2xEsbD6GZLtRa2pV97pPa5MIIdJE6lYSvTl2yAintmoSmasPG bQ2y17Pq/xCVrHiQnWduw5lI6GmE= X-Google-Smtp-Source: AGHT+IFHP3r4dVkcLfoOMw675ky6J7qaMFMnPm2ULbfsaRK96aMpSdw9iX2xB5uz9Zlsa2owoWK8Mp2gPvhq7jXlOL0= X-Received: by 2002:a05:6102:22c8:b0:475:48c9:c4ed with SMTP id a8-20020a05610222c800b0047548c9c4edmr1686929vsh.29.1711191340804; Sat, 23 Mar 2024 03:55:40 -0700 (PDT) MIME-Version: 1.0 References: <01b0b8e8-af1d-4fbe-951e-278e882283fd@linux.dev> In-Reply-To: From: Barry Song <21cnbao@gmail.com> Date: Sat, 23 Mar 2024 18:55:26 +0800 Message-ID: Subject: Re: [External] Re: [bug report] mm/zswap :memory corruption after zswap_load(). To: Chris Li Cc: Zhongkun He , Yosry Ahmed , Chengming Zhou , Johannes Weiner , Andrew Morton , linux-mm , wuyun.abel@bytedance.com, zhouchengming@bytedance.com, Nhat Pham , Kairui Song , Minchan Kim , David Hildenbrand , Ying Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Rspamd-Queue-Id: DC3EE180010 X-Rspam-User: X-Stat-Signature: qxhfh3m8sr7m6uk66b1wpajp5753nadt X-Rspamd-Server: rspam03 X-HE-Tag: 1711191341-543538 X-HE-Meta: U2FsdGVkX1/+RzIsgDhBd2u9/Qy2hgqSCSqqi/SVQuJI4iGNSUvrpkKllfyRSPVAc/4hxWUp0QJzFR2CWqqAyu6jKiYIt0LZ4n4z4jsX/54yBx5gvvORJsxGzeM9gSt7P2CgyJTU/sirVKRXycKRqj0N4ZDQCjnABf+dXLD7hmaXtfJUpUYinRn2QIzuZvqiWqinNCwE41wlE4uvmlEvWWDvkmn1odfWnsIZqBoExGxnpmp0jJeac7KnK5TqzFBFTaJxsx2Nb0EOUc42QHbWEfZBXEOC410r1B748HjCi9/4kAKkyfbcz669uHJYhxsjwMteXMTlc3doHoBrwiLj1ta0+TJL63LXBqS8siYzRhffNUAdK+AMMN3SXX7sU0LPeHbu08Uail5AfsFWPQtofY7aXH7w+kVvvxfqb4iLce1Lnz6OpBAv5wwG46Xtc491AXoY1vtf/gwRNnQ8t5YbfG5E72OtT6dgyIqTIsOz9h0bURClOM3mRGD4g3v8fn+R9rPKPPRvSfDEpCwu7oX5rWGAbXabnaNSbTO4jm5eMQcTsz1vLPmmxUZC+IWzt5k08R9GTZEdMachJtps7b0FBAfD2BM4cKAzPwYWTdIG1j64rB6taqMdJNn1DGF6Ojpu1KQxq7MWZmQ0e3vh48u+Lsayo5XA8t84KLDdqHRBcsE8nvQor4vBzGltjuRU/KPVsZFB2xhtGoIsguB5PQdj1TyXmaZNhdTnqcBrLWgkNx7nA0wAa5+4zARSy2+sqS8iD2lYr0uanzZQjScl9+036ny7IDN6dzVpgefwcXH/jAoZNEyUyN48KLYVeqtP9SyFxTmxYCAdXPLU3mBzyVPyoeHAGg4TOUsjBGIu5RNNtjZhwKt42dWsg7eNVBbIIt5q9vhtHwq/IbE9B9hAOxH364WDsnfWQiFqslOexeMSuDJ1MwNp8boWANTVZtbdqHWzASmQ+UOTUf3uzGmMMTY lMbRrhoE QOD76/Pjj3ZNiS0+zoXQfq7DMLK8fqyNzRlyABAQP9hH/FsE0vqsY2bO1Dnerjicpp/OccCWVkVknhcyBXUBcMnzrN90Qe3vszIP+R8Yz2P7K4gLzjd9o5iAt2RlNCSFmNQrZnkLzgfRxL/Y7LWJUipVUyHPUdYDb6FktEoXQEkd02U61JJWVLCsR7Lg7OED+D3FvF3b7S5u68cRWtqyBsbHp7bOxyxCESV8CDnuy8r4Z5FxGbhtiZ58P609Le4gqC/yauSb8dii0QIuMerWUIlFzlwGJ2bjY59z3vLI+JY99eN9IVbEgbWk213KmzC88/4bO1FOOu2ZktvwIvsYstX3rCz6ZDUnMMv1aqScPMQTG6OPMGs1eyR6GSwBSbYEV+XImet6WdGyL6nQiGabWXK2U8H8HxTwikxOshJ+aD3kJnlgo+XloeN+0TmMVJTTq4Sa262h7V3C/l7gEys5OPwxlRWGJd+wiQiIaB0Tg2b6KUMD6T3bPNvyIHFLkYYYM7Ey9wgDE3mK7NbwTnuEYUPIwN5pnZYUE0e/0K1KqrPNonCjr8fQ0V2KSNo4kuHl0ySFyJjsh2HccT6tZpb71HWx5B69rGTjw2ev+ X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: On Sat, Mar 23, 2024 at 6:52=E2=80=AFPM Chris Li wrote: > > On Fri, Mar 22, 2024 at 6:35=E2=80=AFPM Zhongkun He > wrote: > > > > On Sat, Mar 23, 2024 at 3:35=E2=80=AFAM Yosry Ahmed wrote: > > > > > > On Thu, Mar 21, 2024 at 8:04=E2=80=AFPM Zhongkun He > > > wrote: > > > > > > > > On Thu, Mar 21, 2024 at 5:29=E2=80=AFPM Chengming Zhou wrote: > > > > > > > > > > On 2024/3/21 14:36, Zhongkun He wrote: > > > > > > On Thu, Mar 21, 2024 at 1:24=E2=80=AFPM Chengming Zhou wrote: > > > > > >> > > > > > >> On 2024/3/21 13:09, Zhongkun He wrote: > > > > > >>> On Thu, Mar 21, 2024 at 12:42=E2=80=AFPM Chengming Zhou > > > > > >>> wrote: > > > > > >>>> > > > > > >>>> On 2024/3/21 12:34, Zhongkun He wrote: > > > > > >>>>> Hey folks, > > > > > >>>>> > > > > > >>>>> Recently, I tested the zswap with memory reclaiming in the = mainline > > > > > >>>>> (6.8) and found a memory corruption issue related to exclus= ive loads. > > > > > >>>> > > > > > >>>> Is this fix included? 13ddaf26be32 ("mm/swap: fix race when = skipping swapcache") > > > > > >>>> This fix avoids concurrent swapin using the same swap entry. > > > > > >>>> > > > > > >>> > > > > > >>> Yes, This fix avoids concurrent swapin from different cpu, bu= t the > > > > > >>> reported issue occurs > > > > > >>> on the same cpu. > > > > > >> > > > > > >> I think you may misunderstand the race description in this fix= changelog, > > > > > >> the CPU0 and CPU1 just mean two concurrent threads, not real t= wo CPUs. > > > > > >> > > > > > >> Could you verify if the problem still exists with this fix? > > > > > > > > > > > > Yes=EF=BC=8CI'm sure the problem still exists with this patch. > > > > > > There is some debug info, not mainline. > > > > > > > > > > > > bpftrace -e'k:swap_readpage {printf("%lld, %lld,%ld,%ld,%ld\n%s= ", > > > > > > ((struct page *)arg0)->private,nsecs,tid,pid,cpu,kstack)}' --in= clude > > > > > > linux/mm_types.h > > > > > > > > > > Ok, this problem seems only happen on SWP_SYNCHRONOUS_IO swap bac= kends, > > > > > which now include zram, ramdisk, pmem, nvdimm. > > > > > > > > Yes. > > > > > > > > > > > > > > It maybe not good to use zswap on these swap backends? > > > > > > > > > > The problem here is the page fault handler tries to skip swapcach= e to > > > > > swapin the folio (swap entry count =3D=3D 1), but then it can't i= nstall folio > > > > > to pte entry since some changes happened such as concurrent fork = of entry. > > > > > > > > > > > > > The first page fault returned VM_FAULT_RETRY because > > > > folio_lock_or_retry() failed. > > > > > > > Hi Yosry, > > > > > How so? The folio is newly allocated and not visible to any other > > > threads or CPUs. swap_read_folio() unlocks it and then returns and we > > > immediately try to lock it again with folio_lock_or_retry(). How does > > > this fail? > > > > Haha, it makes me very confused. Based on the steps to reproduce the pr= oblem, > > I think the page is locked by shrink_folio_list(). Please see the > > following situation. > > > > do_swap_page > > __folio_set_locked(folio); > > swap_readpage(page, true, NULL); > > zswap_load(folio) > > folio_unlock(folio); > > > > shrink_folio_list > > > > if (!folio_trylock(folio)) > > ret |=3D folio_lock_or_retry(folio, vmf); > > if (ret & VM_FAULT_RETRY) > > goto out_release; > > Thanks for the detailed bug report. So this means the folio > immediately gets reclaimed after zswap_load(), before do_swap_page > returns, right? > > We also need to audit if there is any other code path in the > do_swap_page that can fail a swap fault and not store the folio into > the swap cache. > > Chris > > > > > Thanks. > > > > > > > > Let's go over what happens after swap_read_folio(): > > > - The 'if (!folio)' code block will be skipped. > > > - folio_lock_or_retry() should succeed as I mentioned earlier. > > > - The 'if (swapcache)' code block will be skipped. > > > - The pte_same() check should succeed on first look because other > > > concurrent faulting threads should be held off by the newly introduce= d > > > swapcache_prepare() logic. But looking deeper I think this one may > > > fail due to a concurrent MADV_WILLNEED. > > > - The 'if (unlikely(!folio_test_uptodate(folio)))` part will be > > > skipped because swap_read_folio() marks the folio up-to-date. > > > - After that point there is no possible failure until we install the > > > pte, at which point concurrent faults will fail on !pte_same() and > > > retry. > > > > > > So the only failure I think is possible is the pte_same() check. I se= e > > > how a concurrent MADV_WILLNEED could cause that check to fail. A > > > concurrent MADV_WILLNEED will block on swapcache_prepare(), but once > > > the fault resolves it will go ahead and read the folio again into the > > > swapcache. It seems like we will end up with two copies of the same > > > folio? Maybe this is harmless because the folio in the swacache will > > > never be used, but it is essentially leaked at that point, right? right. it has got a good fix here to avoid immediate release by zswap: https://lore.kernel.org/linux-mm/20240322234826.GA448621@cmpxchg.org/ > > > > > > I feel like I am missing something. Adding other folks that were > > > involved in the recent swapcache_prepare() synchronization thread. > > > > > > Anyway, I agree that at least in theory the data corruption could > > > happen because of exclusive loads when skipping the swapcache, and we > > > should fix that. > > > > > > Perhaps the right thing to do may be to write the folio again to zswa= p > > > before unlocking it and before calling swapcache_clear(). The need fo= r > > > the write can be detected by checking if the folio is dirty, I think > > > this will only be true if the folio was loaded from zswap. > >