Re: [PATCH] mm: swap_cgroup: fix NULL deref in lookup_swap_cgroup_id on swapless host

[chenxin <chenxinxin@xiaomi.com>]

> > Yes, we would like to backport this patch to the 6.6.y stable tree.
> > We have encountered the same issue on a product running the Android GKI 6.6 kernel.
>
> This is not a 6.6.y fix. The NULL deref is only reachable through the
> batching added by bea67dcc5eea ("mm: attempt to batch free swap entries
> for zap_pte_range()"), which is v6.12 and newer. 6.6.y has no
> swap_pte_batch() at all, so the exit_mmap -> zap_pte_range ->
> lookup_swap_cgroup_id path you are hitting does not exist there and the
> guard would be dead code.
> 
> Your oops is on Android GKI 6.6, which carries the batching backport
> downstream - that is the tree that should carry this fix, alongside the
> commit that makes it reachable.
> 
> -- 
> Thanks,
> Sasha

Thanks a lot for clarifying, as you noted, this commit was backported
to GKI 6.6 by Google, which is what makes the NULL deref reachable there.
I'll follow up with Google to get the fix backported onto the GKI kernel.

Thanks again for your help.

--
Thanks,
Chenxin