releases/3.11.7/mm-zswap-bugfix-memory-leak-when-re-swapon.patch

   1 From aa9bca05a467c61dcea4142b2877d5392de5bdce Mon Sep 17 00:00:00 2001
   2 From: Weijie Yang <weijie.yang@samsung.com>
   3 Date: Wed, 16 Oct 2013 13:46:54 -0700
   4 Subject: mm/zswap: bugfix: memory leak when re-swapon
   5
   6 From: Weijie Yang <weijie.yang@samsung.com>
   7
   8 commit aa9bca05a467c61dcea4142b2877d5392de5bdce upstream.
   9
  10 zswap_tree is not freed when swapoff, and it got re-kmalloced in swapon,
  11 so a memory leak occurs.
  12
  13 Free the memory of zswap_tree in zswap_frontswap_invalidate_area().
  14
  15 Signed-off-by: Weijie Yang <weijie.yang@samsung.com>
  16 Reviewed-by: Bob Liu <bob.liu@oracle.com>
  17 Cc: Minchan Kim <minchan@kernel.org>
  18 Reviewed-by: Minchan Kim <minchan@kernel.org>
  19 From: Weijie Yang <weijie.yang@samsung.com>
  20 Subject: mm/zswap: bugfix: memory leak when invalidate and reclaim occur concurrently
  21 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  22
  23 Consider the following scenario:
  24 thread 0: reclaim entry x (get refcount, but not call zswap_get_swap_cache_page)
  25 thread 1: call zswap_frontswap_invalidate_page to invalidate entry x.
  26         finished, entry x and its zbud is not freed as its refcount != 0
  27         now, the swap_map[x] = 0
  28 thread 0: now call zswap_get_swap_cache_page
  29         swapcache_prepare return -ENOENT because entry x is not used any more
  30         zswap_get_swap_cache_page return ZSWAP_SWAPCACHE_NOMEM
  31         zswap_writeback_entry do nothing except put refcount
  32 Now, the memory of zswap_entry x and its zpage leak.
  33
  34 Modify:
  35  - check the refcount in fail path, free memory if it is not referenced.
  36
  37  - use ZSWAP_SWAPCACHE_FAIL instead of ZSWAP_SWAPCACHE_NOMEM as the fail path
  38    can be not only caused by nomem but also by invalidate.
  39
  40 [akpm@linux-foundation.org: coding-style fixes]
  41 Signed-off-by: Weijie Yang <weijie.yang@samsung.com>
  42 Reviewed-by: Bob Liu <bob.liu@oracle.com>
  43 Cc: Minchan Kim <minchan@kernel.org>
  44 Cc: <stable@vger.kernel.org>
  45 Acked-by: Seth Jennings <sjenning@linux.vnet.ibm.com>
  46
  47 Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
  48 Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
  49
  50 ---
  51  mm/zswap.c |    4 ++++
  52  1 file changed, 4 insertions(+)
  53
  54 --- a/mm/zswap.c
  55 +++ b/mm/zswap.c
  56 @@ -816,6 +816,10 @@ static void zswap_frontswap_invalidate_a
  57         }
  58         tree->rbroot = RB_ROOT;
  59         spin_unlock(&tree->lock);
  60 +
  61 +       zbud_destroy_pool(tree->pool);
  62 +       kfree(tree);
  63 +       zswap_trees[type] = NULL;
  64  }
  65
  66  static struct zbud_ops zswap_zbud_ops = {