mm: fix races between address_space dereference and free in page_evicatable
authorHuang Ying <>
Thu, 5 Apr 2018 23:23:20 +0000 (16:23 -0700)
committerLinus Torvalds <>
Fri, 6 Apr 2018 04:36:25 +0000 (21:36 -0700)
When page_mapping() is called and the mapping is dereferenced in
page_evicatable() through shrink_active_list(), it is possible for the
inode to be truncated and the embedded address space to be freed at the
same time.  This may lead to the following race.

CPU1                                                CPU2

truncate(inode)                                     shrink_active_list()
  ...                                                 page_evictable(page)
  truncate_inode_page(mapping, page);
      spin_lock_irqsave(&mapping->tree_lock, flags);
        __delete_from_page_cache(page, NULL)
            ...                                         mapping = page_mapping(page);
            page->mapping = NULL;
      spin_unlock_irqrestore(&mapping->tree_lock, flags);
      page_cache_free_page(mapping, page)
          if (put_page_testzero(page)) -> false
- inode now has no pages and can be freed including embedded address_space

  test_bit(AS_UNEVICTABLE, &mapping->flags);
- we've dereferenced mapping which is potentially already free.

Similar race exists between swap cache freeing and page_evicatable()

The address_space in inode and swap cache will be freed after a RCU
grace period.  So the races are fixed via enclosing the page_mapping()
and address_space usage in rcu_read_lock/unlock().  Some comments are
added in code to make it clear what is protected by the RCU read lock.

Signed-off-by: "Huang, Ying" <>
Reviewed-by: Jan Kara <>
Reviewed-by: Andrew Morton <>
Cc: Mel Gorman <>
Cc: Minchan Kim <>
Cc: "Huang, Ying" <>
Cc: Johannes Weiner <>
Cc: Michal Hocko <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>

index cd5dc3faaa57d667f14be1074e2e00bb5db8f330..ca566640c44852ab8ce6a1681773ac7bf9b1d2a2 100644 (file)
@@ -3877,7 +3877,13 @@ int node_reclaim(struct pglist_data *pgdat, gfp_t gfp_mask, unsigned int order)
 int page_evictable(struct page *page)
 int page_evictable(struct page *page)
-       return !mapping_unevictable(page_mapping(page)) && !PageMlocked(page);
+       int ret;
+       /* Prevent address_space of inode and swap cache from being freed */
+       rcu_read_lock();
+       ret = !mapping_unevictable(page_mapping(page)) && !PageMlocked(page);
+       rcu_read_unlock();
+       return ret;