linux-kernel - [PATCH 1/3] mm,swap: fix a theoretical underflow in readahead window calculation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20240531081230.310128-2-ying.huang@intel.com>
Date: Fri, 31 May 2024 16:12:28 +0800
From: Huang Ying <ying.huang@...el.com>
To: Andrew Morton <akpm@...ux-foundation.org>
Cc: linux-mm@...ck.org,
	linux-kernel@...r.kernel.org,
	Huang Ying <ying.huang@...el.com>,
	Hugh Dickins <hughd@...gle.com>,
	Alistair Popple <apopple@...dia.com>,
	Anshuman Khandual <anshuman.khandual@....com>,
	David Hildenbrand <david@...hat.com>,
	Mel Gorman <mgorman@...hsingularity.net>,
	Miaohe Lin <linmiaohe@...wei.com>,
	Minchan Kim <minchan@...nel.org>,
	Ryan Roberts <ryan.roberts@....com>,
	Yang Shi <shy828301@...il.com>,
	Yu Zhao <yuzhao@...gle.com>,
	Kairui Song <kasong@...cent.com>,
	Barry Song <v-songbaohua@...o.com>,
	Chris Li <chrisl@...nel.org>,
	Yosry Ahmed <yosryahmed@...gle.com>
Subject: [PATCH 1/3] mm,swap: fix a theoretical underflow in readahead window calculation

In swap readahead window calculation, if the fault PFN is smaller than
the readahead window size, underflow may occurs.  This is only
possible in theory, because the start of the virtual address space
will not be used for anonymous pages in practice.  Even if underflow
occurs, there will be no functional bugs.  In the worst cases, some
swap entries may be swapped in incorrectly and some pages may be
allocate on the wrong nodes.

Anyway, we still needs to fix the issue via some underflow checking.

Fixes: ec560175c0b6 ("mm, swap: VMA based swap readahead")
Signed-off-by: "Huang, Ying" <ying.huang@...el.com>
Cc: Hugh Dickins <hughd@...gle.com>
Cc: Alistair Popple <apopple@...dia.com>
Cc: Anshuman Khandual <anshuman.khandual@....com>
Cc: David Hildenbrand <david@...hat.com>
Cc: Mel Gorman <mgorman@...hsingularity.net>
Cc: Miaohe Lin <linmiaohe@...wei.com>
Cc: Minchan Kim <minchan@...nel.org>
Cc: Ryan Roberts <ryan.roberts@....com>
Cc: Yang Shi <shy828301@...il.com>
Cc: Yu Zhao <yuzhao@...gle.com>
Cc: Kairui Song <kasong@...cent.com>
Cc: Barry Song <v-songbaohua@...o.com>
Cc: Chris Li <chrisl@...nel.org>
Cc: Yosry Ahmed <yosryahmed@...gle.com>
---
 mm/swap_state.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/mm/swap_state.c b/mm/swap_state.c
index 642c30d8376c..848c167df530 100644
--- a/mm/swap_state.c
+++ b/mm/swap_state.c
@@ -787,6 +787,8 @@ static void swap_ra_info(struct vm_fault *vmf,
 		lpfn = fpfn - left;
 		rpfn = fpfn + win - left;
 	}
+	if ((long)lpfn < 0)
+		lpfn = 0;
 	start = max3(lpfn, PFN_DOWN(vma->vm_start),
 		     PFN_DOWN(faddr & PMD_MASK));
 	end = min3(rpfn, PFN_DOWN(vma->vm_end),
-- 
2.39.2