mm: try_to_unuse check removing right swap
mm: try_to_unuse check removing right swap

There's a possible race in try_to_unuse() which Nick Piggin led me to two
years ago.  Where it does lock_page() after read_swap_cache_async(), what
if another task removed that page from swapcache just before we locked it?

It would sail though the (*swap_map > 1) tests doing nothing (because it
could not have been removed from swapcache before its swap references were
gone), until it reaches the delete_from_swap_cache(page) near the bottom.

Now imagine that this page has been allocated to swap on a different swap
area while we dropped page lock (perhaps at the top, perhaps in unuse_mm):
we could wrongly remove from swap cache before the page has been written
to swap, so a subsequent do_swap_page() would read in stale data from
swap.

I think this case could not happen before: remove_exclusive_swap_page()
refused while page count was raised.  But now with reuse_swap_page() and
try_to_free_swap() removing from swap cache without minding page count, I
think it could happen - the previous patch argued that it was safe because
try_to_unuse() already ignored page count, but overlooked that it might be
breaking the assumptions in try_to_unuse() itself.

Signed-off-by: Hugh Dickins <a6c5230a10c458028ff1bd5985dd47c394028d47@veritas.com>
Cc: Lee Schermerhorn <f13429585ed8ee5cbbe1602189e3a516c4ea39be@hp.com>
Cc: Rik van Riel <a21938f5d463ddf41aa718934c205ca2cce8ebbc@redhat.com>
Cc: Nick Piggin <3db79564e4bc2ada42ade8dfd09b5548e4fe6cdf@yahoo.com.au>
Cc: KAMEZAWA Hiroyuki <634f508bd7c47cf0ee4126243675c3e598920fbc@jp.fujitsu.com>
Cc: Robin Holt <fad267d8332d5f62140cfd0120e54d2a812d419e@sgi.com>
Signed-off-by: Andrew Morton <5c1e68b099950c134891f0b6e179498a8ebe9cf9@linux-foundation.org>
Signed-off-by: Linus Torvalds <69652caca27c8b940640ad396ab71f93cacec34f@linux-foundation.org>

TeamVee-Kanas/android_kernel_samsung_kanas,KristFoundation/Programs,KristFoundation/Programs,KristFoundation/Programs,TeamVee-Kanas/android_kernel_samsung_kanas,KristFoundation/Programs,TeamVee-Kanas/android_kernel_samsung_kanas,KristFoundation/Programs,TeamVee-Kanas/android_kernel_samsung_kanas,TeamVee-Kanas/android_kernel_samsung_kanas,KristFoundation/Programs