mm, memcg: Prevent memory.swappiness load/store tearing

The knob for cgroup v1 memory controller: memory.swappiness is not
protected by any locking so it can be modified while it is used.  This is
not an actual problem because races are unlikely.  But it is better to use
[READ|WRITE]_ONCE to prevent compiler from doing anything funky.

The access of memcg->swappiness and vm_swappiness is lockless, so both of
them can be concurrently set at the same time as we are trying to read
them.  All occurrences of memcg->swappiness and vm_swappiness are updated
with [READ|WRITE]_ONCE.

[findns94@gmail.com: v3]
Link: https://lkml.kernel.org/r/20230308162555.14195-3-findns94@gmail.com
Link: https://lkml.kernel.org/r/20230306154138.3775-3-findns94@gmail.com
Signed-off-by: Yue Zhao <findns94@gmail.com>
Acked-by: Michal Hocko <mhocko@suse.com>
Acked-by: Shakeel Butt <shakeelb@google.com>
Acked-by: Roman Gushchin <roman.gushchin@linux.dev>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Muchun Song <muchun.song@linux.dev>
Cc: Tang Yizhou <tangyeechou@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>

diff --git a/include/linux/swap.h b/include/linux/swap.h
index d5d0b54..bfc3b06 100644 (file)
--- a/include/linux/swap.h
+++ b/include/linux/swap.h
@@ -620,18 +620,18 @@ static inline int mem_cgroup_swappiness(struct mem_cgroup *memcg)
 {
        /* Cgroup2 doesn't have per-cgroup swappiness */
        if (cgroup_subsys_on_dfl(memory_cgrp_subsys))
-               return vm_swappiness;
+               return READ_ONCE(vm_swappiness);
 
        /* root ? */
        if (mem_cgroup_disabled() || mem_cgroup_is_root(memcg))
-               return vm_swappiness;
+               return READ_ONCE(vm_swappiness);
 
-       return memcg->swappiness;
+       return READ_ONCE(memcg->swappiness);
 }
 #else
 static inline int mem_cgroup_swappiness(struct mem_cgroup *mem)
 {
-       return vm_swappiness;
+       return READ_ONCE(vm_swappiness);
 }
 #endif
 

diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 06821e5..1b0112a 100644 (file)
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -4179,9 +4179,9 @@ static int mem_cgroup_swappiness_write(struct cgroup_subsys_state *css,
                return -EINVAL;
 
        if (!mem_cgroup_is_root(memcg))
-               memcg->swappiness = val;
+               WRITE_ONCE(memcg->swappiness, val);
        else
-               vm_swappiness = val;
+               WRITE_ONCE(vm_swappiness, val);
 
        return 0;
 }
@@ -5353,7 +5353,7 @@ mem_cgroup_css_alloc(struct cgroup_subsys_state *parent_css)
 #endif
        page_counter_set_high(&memcg->swap, PAGE_COUNTER_MAX);
        if (parent) {
-               memcg->swappiness = mem_cgroup_swappiness(parent);
+               WRITE_ONCE(memcg->swappiness, mem_cgroup_swappiness(parent));
                memcg->oom_kill_disable = parent->oom_kill_disable;
 
                page_counter_init(&memcg->memory, &parent->memory);