From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from lgeamrelo07.lge.com (lgeamrelo07.lge.com [156.147.51.103]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8BCC013959D for ; Mon, 1 Dec 2025 10:42:48 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=156.147.51.103 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764585773; cv=none; b=XFIm7ugE2eVsFKvyMd1XbvwYN5oslyUzkR5DRox0Cuav5G+S43qpudRrfTSBhfM82rTzdUDPxl/IXuLxu/p1zNmZ69TmP7YAl5Sxf8bskKZEiQC2mbh9QSOURiaRezeJOJTLAmUdugWUm6o2xVfGPi/r++Nx1RDVgMpkSwL90V4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764585773; c=relaxed/simple; bh=lhh6FuqN+YiYLmLBq2Zc0MJKTs+bS80+aIvEUE41Fhk=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=l+QcX5Z4zdWXAUd6p37OH1c2FZn4Yfq2lUovzz+/k/gDmf9bkMBkN4Z6SfgUJK4qGPiv0c4jcXteGLi3SfUAwPGP4w9KKO+UXTBgcS62DsOMtZWVROXaZpBZW6G5YSDG3a8Pkg4nnxeY1wfzhGDKtbU0zYIcWQzMafXtYKrrRUg= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=lge.com; spf=pass smtp.mailfrom=lge.com; arc=none smtp.client-ip=156.147.51.103 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=lge.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=lge.com Received: from unknown (HELO yjaykim-PowerEdge-T330) (10.177.112.156) by 156.147.51.103 with ESMTP; 1 Dec 2025 19:27:46 +0900 X-Original-SENDERIP: 10.177.112.156 X-Original-MAILFROM: youngjun.park@lge.com Date: Mon, 1 Dec 2025 19:27:46 +0900 From: YoungJun Park To: Deepanshu Kartikey Cc: akpm@linux-foundation.org, chrisl@kernel.org, kasong@tencent.com, shikemeng@huaweicloud.com, nphamcs@gmail.com, bhe@redhat.com, baohua@kernel.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org, syzbot+d7bc9ec4a100437aa7a2@syzkaller.appspotmail.com Subject: Re: [PATCH] mm/swapfile: validate swap offset in unuse_pte_range() Message-ID: References: <20251201093741.730884-1-kartikey406@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20251201093741.730884-1-kartikey406@gmail.com> On Mon, Dec 01, 2025 at 03:07:41PM +0530, Deepanshu Kartikey wrote: > syzbot reported a WARNING in __swap_offset_to_cluster() triggered by > an invalid swap offset during swapoff: > > WARNING: CPU: 0 PID: 9861 at mm/swap.h:87 swap_cache_get_folio+0x186/0x200 > > The issue occurs because unuse_pte_range() extracts a swap entry from > a PTE and uses the offset without validating it is within bounds of > the swap area. > > While the existing swp_type() check filters entries for other swap > areas, it cannot catch cases where the type bits are valid but the > offset is corrupted or stale - for example, due to a race condition > during PTE updates or memory corruption. Since this indicates a system-level issue (race/corruption), simply avoiding the crash seems to be the goal here. Should we at least add a WARN_ON or somthing? (Unless this corruption is expected to be reported elsewhere beforehand, in which case a silent skip is fine as I think) And it looks like swap_vma_readahead() share similar logic. The differene is intentionally allow entries from different swap devices (to support vma readahead). If the offset is corrupted or invalid in those paths, wouldn't they suffer from similar issues? Do you think we should add the boundary check (offset >= si->max) there as well? Best Regards, Youngjun Park > > Reported-by: syzbot+d7bc9ec4a100437aa7a2@syzkaller.appspotmail.com > Closes: https://syzkaller.appspot.com/bug?extid=d7bc9ec4a100437aa7a2 > Signed-off-by: Deepanshu Kartikey > --- > mm/swapfile.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/mm/swapfile.c b/mm/swapfile.c > index 46d2008e4b99..fdf358df7116 100644 > --- a/mm/swapfile.c > +++ b/mm/swapfile.c > @@ -2277,6 +2277,8 @@ static int unuse_pte_range(struct vm_area_struct *vma, pmd_t *pmd, > continue; > > offset = swp_offset(entry); > + if (offset >= si->max) > + continue; > pte_unmap(pte); > pte = NULL; > > -- > 2.43.0