linux-kernel - [BUGFIX][PATCH] fix corruption of hibernation caused by reusing swap at saving image

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20100804105054.af68ee5c.kamezawa.hiroyu@jp.fujitsu.com>
Date:	Wed, 4 Aug 2010 10:50:54 +0900
From:	KAMEZAWA Hiroyuki <kamezawa.hiroyu@...fujitsu.com>
To:	KAMEZAWA Hiroyuki <kamezawa.hiroyu@...fujitsu.com>
Cc:	Andrea Gelmini <andrea.gelmini@...il.com>,
	"Rafael J. Wysocki" <rjw@...k.pl>,
	Ondrej Zary <linux@...nbow-software.org>,
	Kernel development list <linux-kernel@...r.kernel.org>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Balbir Singh <balbir@...ibm.com>, nigel@...onice.net,
	stable@...nel.org, Hugh Dickins <hughd@...gle.com>
Subject: [BUGFIX][PATCH] fix corruption of hibernation caused by reusing
 swap at saving image

This patch is created against 2.6.35. CC'ed stable.
Thank you for all helps.

=
From: KAMEZAWA Hiroyuki <kamezawa.hiroyu@...fujitsu.com>

Since 2.6.31, swap_map[]'s refcounting was changed to show that
a used swap entry is just for swap-cache, can be reused.
Then, while scanning free entry in swap_map[], a swap entry may
be able to be reclaimed and reused. It was by the commit
c9e444103b5e7a5a3519f9913f59767f92e33baf.

But this caused deta corruption at hibernation. Considering how
the image is saved, the calls of try_to_reclaim_swap() changes the
status of memory and there will be inconsitency between saved-memory-image's
swap_map[] / memmap / swapper_space because memory is saved per page with
swap-allocation per page.

This patch is for avoiding bug by not reclaiming swap-entry at hibernation.
This is a quick fix for backporting.

Cc: stable@...nel.org
Cc: Rafael J. Wysocki <rjw@...k.pl>
Reported-by: Ondreg Zary <linux@...nbow-software.org>
Tested-by: Andrea Gelmini <andrea.gelmini@...il.com>
Acked-by: Hugh Dickins <hughd@...gle.com>
Signed-off-by: KAMEZAWA Hiroyuki <kamezawa.hiroyu@...fujitsu.com>
---
 mm/swapfile.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

Index: linux-2.6.35.org/mm/swapfile.c
===================================================================
--- linux-2.6.35.org.orig/mm/swapfile.c
+++ linux-2.6.35.org/mm/swapfile.c
@@ -318,8 +318,10 @@ checks:
 	if (offset > si->highest_bit)
 		scan_base = offset = si->lowest_bit;
 
-	/* reuse swap entry of cache-only swap if not busy. */
-	if (vm_swap_full() && si->swap_map[offset] == SWAP_HAS_CACHE) {
+	/* reuse swap entry of cache-only swap if not hibernation. */
+	if (vm_swap_full()
+		&& usage == SWAP_HAS_CACHE
+		&& si->swap_map[offset] == SWAP_HAS_CACHE) {
 		int swap_was_freed;
 		spin_unlock(&swap_lock);
 		swap_was_freed = __try_to_reclaim_swap(si, offset);

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/