Skip to content
Snippets Groups Projects
  • Christoph Hellwig's avatar
    37dcc673
    frontswap: don't call ->init if no ops are registered · 37dcc673
    Christoph Hellwig authored
    If no frontswap module (i.e.  zswap) was registered, frontswap_ops will be
    NULL.  In such situation, swapon crashes with the following stack trace:
    
      Unable to handle kernel access to user memory outside uaccess routines at virtual address 0000000000000000
      Mem abort info:
        ESR = 0x0000000096000004
        EC = 0x25: DABT (current EL), IL = 32 bits
        SET = 0, FnV = 0
        EA = 0, S1PTW = 0
        FSC = 0x04: level 0 translation fault
      Data abort info:
        ISV = 0, ISS = 0x00000004
        CM = 0, WnR = 0
      user pgtable: 4k pages, 48-bit VAs, pgdp=00000020a4fab000
      [0000000000000000] pgd=0000000000000000, p4d=0000000000000000
      Internal error: Oops: 96000004 [#1] SMP
      Modules linked in: zram fsl_dpaa2_eth pcs_lynx phylink ahci_qoriq crct10dif_ce ghash_ce sbsa_gwdt fsl_mc_dpio nvme lm90 nvme_core at803x xhci_plat_hcd rtc_fsl_ftm_alarm xgmac_mdio ahci_platform i2c_imx ip6_tables ip_tables fuse
      Unloaded tainted modules: cppc_cpufreq():1
      CPU: 10 PID: 761 Comm: swapon Not tainted 6.0.0-rc2-00454-g22100432cf14 #1
      Hardware name: SolidRun Ltd. SolidRun CEX7 Platform, BIOS EDK II Jun 21 2022
      pstate: 00400005 (nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
      pc : frontswap_init+0x38/0x60
      lr : __do_sys_swapon+0x8a8/0x9f4
      sp : ffff80000969bcf0
      x29: ffff80000969bcf0 x28: ffff37bee0d8fc00 x27: ffff80000a7f5000
      x26: fffffcdefb971e80 x25: ffffaba797453b90 x24: 0000000000000064
      x23: ffff37c1f209d1a8 x22: ffff37bee880e000 x21: ffffaba797748560
      x20: ffff37bee0d8fce4 x19: ffffaba797748488 x18: 0000000000000014
      x17: 0000000030ec029a x16: ffffaba795a479b0 x15: 0000000000000000
      x14: 0000000000000000 x13: 0000000000000030 x12: 0000000000000001
      x11: ffff37c63c0aba18 x10: 0000000000000000 x9 : ffffaba7956b8c88
      x8 : ffff80000969bcd0 x7 : 0000000000000000 x6 : 0000000000000000
      x5 : 0000000000000001 x4 : 0000000000000000 x3 : ffffaba79730f000
      x2 : ffff37bee0d8fc00 x1 : 0000000000000000 x0 : 0000000000000000
      Call trace:
      frontswap_init+0x38/0x60
      __do_sys_swapon+0x8a8/0x9f4
      __arm64_sys_swapon+0x28/0x3c
      invoke_syscall+0x78/0x100
      el0_svc_common.constprop.0+0xd4/0xf4
      do_el0_svc+0x38/0x4c
      el0_svc+0x34/0x10c
      el0t_64_sync_handler+0x11c/0x150
      el0t_64_sync+0x190/0x194
      Code: d000e283 910003fd f9006c41 f946d461 (f9400021)
      ---[ end trace 0000000000000000 ]---
    
    Link: https://lkml.kernel.org/r/20220909130829.3262926-1-hch@lst.de
    
    
    Fixes: 1da0d94a ("frontswap: remove support for multiple ops")
    Reported-by: default avatarNathan Chancellor <nathan@kernel.org>
    Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
    Signed-off-by: default avatarLiu Shixin <liushixin2@huawei.com>
    Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
    37dcc673
    History
    frontswap: don't call ->init if no ops are registered
    Christoph Hellwig authored
    If no frontswap module (i.e.  zswap) was registered, frontswap_ops will be
    NULL.  In such situation, swapon crashes with the following stack trace:
    
      Unable to handle kernel access to user memory outside uaccess routines at virtual address 0000000000000000
      Mem abort info:
        ESR = 0x0000000096000004
        EC = 0x25: DABT (current EL), IL = 32 bits
        SET = 0, FnV = 0
        EA = 0, S1PTW = 0
        FSC = 0x04: level 0 translation fault
      Data abort info:
        ISV = 0, ISS = 0x00000004
        CM = 0, WnR = 0
      user pgtable: 4k pages, 48-bit VAs, pgdp=00000020a4fab000
      [0000000000000000] pgd=0000000000000000, p4d=0000000000000000
      Internal error: Oops: 96000004 [#1] SMP
      Modules linked in: zram fsl_dpaa2_eth pcs_lynx phylink ahci_qoriq crct10dif_ce ghash_ce sbsa_gwdt fsl_mc_dpio nvme lm90 nvme_core at803x xhci_plat_hcd rtc_fsl_ftm_alarm xgmac_mdio ahci_platform i2c_imx ip6_tables ip_tables fuse
      Unloaded tainted modules: cppc_cpufreq():1
      CPU: 10 PID: 761 Comm: swapon Not tainted 6.0.0-rc2-00454-g22100432cf14 #1
      Hardware name: SolidRun Ltd. SolidRun CEX7 Platform, BIOS EDK II Jun 21 2022
      pstate: 00400005 (nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
      pc : frontswap_init+0x38/0x60
      lr : __do_sys_swapon+0x8a8/0x9f4
      sp : ffff80000969bcf0
      x29: ffff80000969bcf0 x28: ffff37bee0d8fc00 x27: ffff80000a7f5000
      x26: fffffcdefb971e80 x25: ffffaba797453b90 x24: 0000000000000064
      x23: ffff37c1f209d1a8 x22: ffff37bee880e000 x21: ffffaba797748560
      x20: ffff37bee0d8fce4 x19: ffffaba797748488 x18: 0000000000000014
      x17: 0000000030ec029a x16: ffffaba795a479b0 x15: 0000000000000000
      x14: 0000000000000000 x13: 0000000000000030 x12: 0000000000000001
      x11: ffff37c63c0aba18 x10: 0000000000000000 x9 : ffffaba7956b8c88
      x8 : ffff80000969bcd0 x7 : 0000000000000000 x6 : 0000000000000000
      x5 : 0000000000000001 x4 : 0000000000000000 x3 : ffffaba79730f000
      x2 : ffff37bee0d8fc00 x1 : 0000000000000000 x0 : 0000000000000000
      Call trace:
      frontswap_init+0x38/0x60
      __do_sys_swapon+0x8a8/0x9f4
      __arm64_sys_swapon+0x28/0x3c
      invoke_syscall+0x78/0x100
      el0_svc_common.constprop.0+0xd4/0xf4
      do_el0_svc+0x38/0x4c
      el0_svc+0x34/0x10c
      el0t_64_sync_handler+0x11c/0x150
      el0t_64_sync+0x190/0x194
      Code: d000e283 910003fd f9006c41 f946d461 (f9400021)
      ---[ end trace 0000000000000000 ]---
    
    Link: https://lkml.kernel.org/r/20220909130829.3262926-1-hch@lst.de
    
    
    Fixes: 1da0d94a ("frontswap: remove support for multiple ops")
    Reported-by: default avatarNathan Chancellor <nathan@kernel.org>
    Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
    Signed-off-by: default avatarLiu Shixin <liushixin2@huawei.com>
    Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
frontswap.c 7.90 KiB
// SPDX-License-Identifier: GPL-2.0-only
/*
 * Frontswap frontend
 *
 * This code provides the generic "frontend" layer to call a matching
 * "backend" driver implementation of frontswap.  See
 * Documentation/mm/frontswap.rst for more information.
 *
 * Copyright (C) 2009-2012 Oracle Corp.  All rights reserved.
 * Author: Dan Magenheimer
 */

#include <linux/mman.h>
#include <linux/swap.h>
#include <linux/swapops.h>
#include <linux/security.h>
#include <linux/module.h>
#include <linux/debugfs.h>
#include <linux/frontswap.h>
#include <linux/swapfile.h>

DEFINE_STATIC_KEY_FALSE(frontswap_enabled_key);

/*
 * frontswap_ops are added by frontswap_register_ops, and provide the
 * frontswap "backend" implementation functions.  Multiple implementations
 * may be registered, but implementations can never deregister.  This
 * is a simple singly-linked list of all registered implementations.
 */
static const struct frontswap_ops *frontswap_ops __read_mostly;

#ifdef CONFIG_DEBUG_FS
/*
 * Counters available via /sys/kernel/debug/frontswap (if debugfs is
 * properly configured).  These are for information only so are not protected
 * against increment races.
 */
static u64 frontswap_loads;
static u64 frontswap_succ_stores;
static u64 frontswap_failed_stores;
static u64 frontswap_invalidates;

static inline void inc_frontswap_loads(void)
{
	data_race(frontswap_loads++);
}
static inline void inc_frontswap_succ_stores(void)
{
	data_race(frontswap_succ_stores++);
}
static inline void inc_frontswap_failed_stores(void)
{
	data_race(frontswap_failed_stores++);
}
static inline void inc_frontswap_invalidates(void)
{
	data_race(frontswap_invalidates++);
}
#else
static inline void inc_frontswap_loads(void) { }
static inline void inc_frontswap_succ_stores(void) { }
static inline void inc_frontswap_failed_stores(void) { }
static inline void inc_frontswap_invalidates(void) { }
#endif

/*
 * Due to the asynchronous nature of the backends loading potentially
 * _after_ the swap system has been activated, we have chokepoints
 * on all frontswap functions to not call the backend until the backend
 * has registered.
 *
 * This would not guards us against the user deciding to call swapoff right as
 * we are calling the backend to initialize (so swapon is in action).
 * Fortunately for us, the swapon_mutex has been taken by the callee so we are
 * OK. The other scenario where calls to frontswap_store (called via
 * swap_writepage) is racing with frontswap_invalidate_area (called via
 * swapoff) is again guarded by the swap subsystem.
 *
 * While no backend is registered all calls to frontswap_[store|load|
 * invalidate_area|invalidate_page] are ignored or fail.
 *
 * The time between the backend being registered and the swap file system
 * calling the backend (via the frontswap_* functions) is indeterminate as
 * frontswap_ops is not atomic_t (or a value guarded by a spinlock).
 * That is OK as we are comfortable missing some of these calls to the newly
 * registered backend.
 *
 * Obviously the opposite (unloading the backend) must be done after all
 * the frontswap_[store|load|invalidate_area|invalidate_page] start
 * ignoring or failing the requests.  However, there is currently no way
 * to unload a backend once it is registered.
 */

/*
 * Register operations for frontswap
 */
int frontswap_register_ops(const struct frontswap_ops *ops)
{
	if (frontswap_ops)
		return -EINVAL;

	frontswap_ops = ops;
	static_branch_inc(&frontswap_enabled_key);
	return 0;
}

/*
 * Called when a swap device is swapon'd.
 */
void frontswap_init(unsigned type, unsigned long *map)
{
	struct swap_info_struct *sis = swap_info[type];

	VM_BUG_ON(sis == NULL);

	/*
	 * p->frontswap is a bitmap that we MUST have to figure out which page
	 * has gone in frontswap. Without it there is no point of continuing.
	 */
	if (WARN_ON(!map))
		return;
	/*
	 * Irregardless of whether the frontswap backend has been loaded
	 * before this function or it will be later, we _MUST_ have the
	 * p->frontswap set to something valid to work properly.
	 */
	frontswap_map_set(sis, map);

	if (!frontswap_enabled())
		return;
	frontswap_ops->init(type);
}

static bool __frontswap_test(struct swap_info_struct *sis,
				pgoff_t offset)
{
	if (sis->frontswap_map)
		return test_bit(offset, sis->frontswap_map);
	return false;
}

static inline void __frontswap_set(struct swap_info_struct *sis,
				   pgoff_t offset)
{
	set_bit(offset, sis->frontswap_map);
	atomic_inc(&sis->frontswap_pages);
}

static inline void __frontswap_clear(struct swap_info_struct *sis,
				     pgoff_t offset)
{
	clear_bit(offset, sis->frontswap_map);
	atomic_dec(&sis->frontswap_pages);
}

/*
 * "Store" data from a page to frontswap and associate it with the page's
 * swaptype and offset.  Page must be locked and in the swap cache.
 * If frontswap already contains a page with matching swaptype and
 * offset, the frontswap implementation may either overwrite the data and
 * return success or invalidate the page from frontswap and return failure.
 */
int __frontswap_store(struct page *page)
{
	int ret = -1;
	swp_entry_t entry = { .val = page_private(page), };
	int type = swp_type(entry);
	struct swap_info_struct *sis = swap_info[type];
	pgoff_t offset = swp_offset(entry);

	VM_BUG_ON(!frontswap_ops);
	VM_BUG_ON(!PageLocked(page));
	VM_BUG_ON(sis == NULL);

	/*
	 * If a dup, we must remove the old page first; we can't leave the
	 * old page no matter if the store of the new page succeeds or fails,
	 * and we can't rely on the new page replacing the old page as we may
	 * not store to the same implementation that contains the old page.
	 */
	if (__frontswap_test(sis, offset)) {
		__frontswap_clear(sis, offset);
		frontswap_ops->invalidate_page(type, offset);
	}

	ret = frontswap_ops->store(type, offset, page);
	if (ret == 0) {
		__frontswap_set(sis, offset);
		inc_frontswap_succ_stores();
	} else {
		inc_frontswap_failed_stores();
	}

	return ret;
}

/*
 * "Get" data from frontswap associated with swaptype and offset that were
 * specified when the data was put to frontswap and use it to fill the
 * specified page with data. Page must be locked and in the swap cache.
 */
int __frontswap_load(struct page *page)
{
	int ret = -1;
	swp_entry_t entry = { .val = page_private(page), };
	int type = swp_type(entry);
	struct swap_info_struct *sis = swap_info[type];
	pgoff_t offset = swp_offset(entry);

	VM_BUG_ON(!frontswap_ops);
	VM_BUG_ON(!PageLocked(page));
	VM_BUG_ON(sis == NULL);

	if (!__frontswap_test(sis, offset))
		return -1;

	/* Try loading from each implementation, until one succeeds. */
	ret = frontswap_ops->load(type, offset, page);
	if (ret == 0)
		inc_frontswap_loads();
	return ret;
}

/*
 * Invalidate any data from frontswap associated with the specified swaptype
 * and offset so that a subsequent "get" will fail.
 */
void __frontswap_invalidate_page(unsigned type, pgoff_t offset)
{
	struct swap_info_struct *sis = swap_info[type];

	VM_BUG_ON(!frontswap_ops);
	VM_BUG_ON(sis == NULL);

	if (!__frontswap_test(sis, offset))
		return;

	frontswap_ops->invalidate_page(type, offset);
	__frontswap_clear(sis, offset);
	inc_frontswap_invalidates();
}

/*
 * Invalidate all data from frontswap associated with all offsets for the
 * specified swaptype.
 */
void __frontswap_invalidate_area(unsigned type)
{
	struct swap_info_struct *sis = swap_info[type];

	VM_BUG_ON(!frontswap_ops);
	VM_BUG_ON(sis == NULL);

	if (sis->frontswap_map == NULL)
		return;

	frontswap_ops->invalidate_area(type);
	atomic_set(&sis->frontswap_pages, 0);
	bitmap_zero(sis->frontswap_map, sis->max);
}

static int __init init_frontswap(void)
{
#ifdef CONFIG_DEBUG_FS
	struct dentry *root = debugfs_create_dir("frontswap", NULL);
	if (root == NULL)
		return -ENXIO;
	debugfs_create_u64("loads", 0444, root, &frontswap_loads);
	debugfs_create_u64("succ_stores", 0444, root, &frontswap_succ_stores);
	debugfs_create_u64("failed_stores", 0444, root,
			   &frontswap_failed_stores);
	debugfs_create_u64("invalidates", 0444, root, &frontswap_invalidates);
#endif
	return 0;
}

module_init(init_frontswap);