linux-kernel - Data corruption problem with swapfiles and THP

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <YRU5NAD+G9DVFYM/@casper.infradead.org>
Date:   Thu, 12 Aug 2021 16:07:32 +0100
From:   Matthew Wilcox <willy@...radead.org>
To:     Huang Ying <ying.huang@...el.com>, linux-kernel@...r.kernel.org,
        linux-mm@...ck.org
Subject: Data corruption problem with swapfiles and THP

There is an assumption in the swap writepage path that a THP is physically
contiguous on swap:

        bio->bi_iter.bi_sector = swap_page_sector(page);
        bio->bi_opf = REQ_OP_WRITE | REQ_SWAP | wbc_to_write_flags(wbc);
        bio->bi_end_io = end_write_func;
        bio_add_page(bio, page, thp_size(page), 0);

As far as I can tell, this is not necessarily true.  If a file is not
contiguous, we can have an extent which is 1MB long followed by an extent
somewhere else on storage that's 1MB long.  When we try to write a 2MB
page to swap, we overwrite whatever's on the block device after that
first 1MB extent.

(Came across this by code examination while looking at getting rid of
the bio path entirely; no attempt has been made to produce this problem;
something else may prevent it from actually happening)