linux-kernel - Re: [PATCH RFC] mm: Fix kernel BUG when userfaultfd

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Z7Zbz7_39JZgdLYa@x1.local>
Date: Wed, 19 Feb 2025 17:31:43 -0500
From: Peter Xu <peterx@...hat.com>
To: Barry Song <21cnbao@...il.com>
Cc: linux-mm@...ck.org, akpm@...ux-foundation.org,
	linux-kernel@...r.kernel.org, zhengtangquan@...o.com,
	Barry Song <v-songbaohua@...o.com>,
	Andrea Arcangeli <aarcange@...hat.com>,
	Suren Baghdasaryan <surenb@...gle.com>,
	Al Viro <viro@...iv.linux.org.uk>,
	Axel Rasmussen <axelrasmussen@...gle.com>,
	Brian Geffon <bgeffon@...gle.com>,
	Christian Brauner <brauner@...nel.org>,
	David Hildenbrand <david@...hat.com>,
	Hugh Dickins <hughd@...gle.com>, Jann Horn <jannh@...gle.com>,
	Kalesh Singh <kaleshsingh@...gle.com>,
	"Liam R . Howlett" <Liam.Howlett@...cle.com>,
	Lokesh Gidra <lokeshgidra@...gle.com>,
	Matthew Wilcox <willy@...radead.org>,
	Michal Hocko <mhocko@...e.com>, Mike Rapoport <rppt@...nel.org>,
	Nicolas Geoffray <ngeoffray@...gle.com>,
	Ryan Roberts <ryan.roberts@....com>, Shuah Khan <shuah@...nel.org>,
	ZhangPeng <zhangpeng362@...wei.com>
Subject: Re: [PATCH RFC] mm: Fix kernel BUG when userfaultfd_move encounters
 swapcache

On Thu, Feb 20, 2025 at 12:25:19AM +1300, Barry Song wrote:
> @@ -1079,9 +1080,19 @@ static int move_swap_pte(struct mm_struct *mm,
>  			 pmd_t *dst_pmd, pmd_t dst_pmdval,
>  			 spinlock_t *dst_ptl, spinlock_t *src_ptl)
>  {
> +	struct folio *folio;
> +	swp_entry_t entry;
> +
>  	if (!pte_swp_exclusive(orig_src_pte))
>  		return -EBUSY;
>  
> +	entry = pte_to_swp_entry(orig_src_pte);
> +	folio = filemap_get_folio(swap_address_space(entry), swap_cache_index(entry));

[Besides what's being discussed elsewhere..]

swap_cache_get_folio() says:

 * Caller must lock the swap device or hold a reference to keep it valid.

Do we need get_swap_device() too here to avoid swapoff race?

> +	if (!IS_ERR(folio)) {
> +		folio_put(folio);
> +		return -EBUSY;
> +	}
> +
>  	double_pt_lock(dst_ptl, src_ptl);
>  
>  	if (!is_pte_pages_stable(dst_pte, src_pte, orig_dst_pte, orig_src_pte,
> -- 
> 2.39.3 (Apple Git-146)
> 

-- 
Peter Xu