From nobody Fri Sep 25 22:19:53 2026 Received: from m16.mail.163.com (m16.mail.163.com [220.197.31.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1A3542DFA3A; Tue, 8 Sep 2026 01:29:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=220.197.31.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788830959; cv=none; b=EyrkDB5ntfDY2Nzryhqshh1cdtOiwk3/AnkEeFeCQTbOMbRheJ8B3DUUT9V9zpioRjJVChN+yO7DZOEj9uFDQwi/hHz7yG1P/DvBlaOcKB98FaB2QmrZv6j0qZpaZ+7YOv8HNMDgoRCTQmnSqJdtZsJOTB+srMFO3WlPZ39g2+o= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788830959; c=relaxed/simple; bh=2z+5QJRQOIyUKvEiYatSJHcBERjX55mCjVJlRNbtTKM=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Oe6yZkfSzu8xCJ6rAeH3r06qUk1KggN3KHTspOBhPozLP+q4+qroHBkiGroB+TkFJf4YA0IraJIOeXYgNnHVfTb0/GsR22KJ3mER+MvgTi+4ne1Jn4d7VNUQJMnxzkaYR4SdA8GN/8qSdLSBeieewHQm3X9XSgz8U1i5w1ECf84= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=163.com; spf=pass smtp.mailfrom=163.com; dkim=pass (1024-bit key) header.d=163.com header.i=@163.com header.b=AJRoT++H; arc=none smtp.client-ip=220.197.31.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=163.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=163.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=163.com header.i=@163.com header.b="AJRoT++H" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=163.com; s=s110527; h=From:To:Subject:Date:Message-ID:MIME-Version; bh=gV ulFbo+Xlb+gZYwWyf9RSx+niLz2941rDVq59YkMVQ=; b=AJRoT++HQHMkq5tNQ7 dleQ8IpE0khpIpVfe+qVCxpGlN0IFUMStRrP886MnYVaVahTvaSGZqhJ/WU3YEpL sIoph7KGyTNVHCMxqbkTuTrMnr7kfwIZWGvosrAbnNca4RzD9MDjbuuggwckOk5X uUSOJz7euUeSHaIJIghxm4iLE= Received: from XLL-9950X.localdomain (unknown []) by gzga-smtp-mtada-g0-3 (Coremail) with SMTP id _____wBX5g6wZJ9qrohVBQ--.12557S2; Tue, 08 Sep 2026 09:28:18 +0800 (CST) From: Longlong Xia To: yosry@kernel.org Cc: akpm@linux-foundation.org, chengming.zhou@linux.dev, hannes@cmpxchg.org, linux-kernel@vger.kernel.org, linux-mm@kvack.org, nphamcs@gmail.com, stable@vger.kernel.org, xialonglong2025@163.com, xialonglong@kylinos.cn, Sashiko Subject: [PATCH v2] mm/zswap: publish the initial pool with list_add_rcu() Date: Tue, 8 Sep 2026 09:28:01 +0800 Message-ID: <20260908012801.1864430-1-xialonglong2025@163.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-CM-TRANSID: _____wBX5g6wZJ9qrohVBQ--.12557S2 X-Coremail-Antispam: 1Uf129KBjvJXoW7uFykuFWUCFy7JFWDtryfCrg_yoW8CF43pF WfWr9xKFWUXr92yrWDJ3Wj9rn5tw4DJF4fKr1UGF4xZwn5Cr1ay34ftr9Yqas2v3ykC3yU WrWkZw17Jr1YkFJanT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDUYxBIdaVFxhVjvjDU0xZFpf9x0piPCztUUUUU= X-CM-SenderInfo: x0ldz0pqjo00rjsqjki6rwjhhfrp/xtbC3BPHwGqfZLOE7QAA3D Content-Type: text/plain; charset="utf-8" From: Longlong Xia zswap_setup() publishes the pool on the zswap_pools list with a plain list_add(), but the list is walked by concurrent RCU readers holding nothing but rcu_read_lock() through zswap_total_pages(), e.g. /proc/meminfo and the shrinker count path. CPU 0 (writer) CPU 1 (reader) -------------- -------------- zswap_pool_create(): pool->zs_pool =3D zs_create_pool(); (1) list_add() -> __list_add(): WRITE_ONCE(zswap_pools.next, &pool->list); (2) zswap_total_pages(): pool =3D READ_ONCE( (a) zswap_pools.next); zs_get_total_pages( (b) pool->zs_pool); If (2) becomes visible to CPU 1 before (1), CPU 1 finds the pool at (a) but dereferences a wild pointer at (b). Publish the node with list_add_rcu(). Fixes: 91cdcd8d624bf ("mm: zswap: optimize zswap pool size tracking") Cc: stable@vger.kernel.org Assisted-by: Zcode:GLM-5.3 Reported-by: Sashiko Link: https://sashiko.dev/#/patchset/20260906133601.3563324-1-xialonglong20= 25%40163.com Acked-by: Yosry Ahmed Signed-off-by: Longlong Xia Acked-by: Nhat Pham --- Changes in v2: - Add Reported-by: and Link: trailers pointing at the Sashiko report, as suggested by Yosry Ahmed. - Collect Acked-by from Yosry Ahmed. No code changes since v1. mm/zswap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mm/zswap.c b/mm/zswap.c index 37f34e406c8e..cb5a0855fd2a 100644 --- a/mm/zswap.c +++ b/mm/zswap.c @@ -1803,7 +1803,7 @@ static int zswap_setup(void) pool =3D __zswap_pool_create_fallback(); if (pool) { pr_info("loaded using pool %s\n", pool->tfm_name); - list_add(&pool->list, &zswap_pools); + list_add_rcu(&pool->list, &zswap_pools); zswap_has_pool =3D true; static_branch_enable(&zswap_ever_enabled); } else { --=20 2.43.0