linux-kernel - Re: [PATCH] mm: swap: Avoid infinite loop if no valid swap entry found during do_swap

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAMgjq7AfZnwGAHoyCEhO5p2km-gPLk65WLL+2vO1i8hQDaTy+A@mail.gmail.com>
Date: Sat, 22 Feb 2025 15:33:32 +0800
From: Kairui Song <ryncsn@...il.com>
To: Wupeng Ma <mawupeng1@...wei.com>
Cc: akpm@...ux-foundation.org, david@...hat.com, ryan.roberts@....com, 
	chrisl@...nel.org, huang.ying.caritas@...il.com, schatzberg.dan@...il.com, 
	baohua@...nel.org, hanchuanhua@...o.com, willy@...radead.org, 
	gaoxu2@...or.com, linux-mm@...ck.org, linux-kernel@...r.kernel.org, 
	Nhat Pham <nphamcs@...il.com>, Yosry Ahmed <yosryahmed@...gle.com>
Subject: Re: [PATCH] mm: swap: Avoid infinite loop if no valid swap entry
 found during do_swap_page

On Sat, Feb 22, 2025 at 10:56 AM Wupeng Ma <mawupeng1@...wei.com> wrote:
>
> From: Ma Wupeng <mawupeng1@...wei.com>
>
> During our test, infinite loop is produced during #PF will lead to infinite
> error log as follow:
>
>    get_swap_device: Bad swap file entry 114000000
>
> Digging into the source, we found that the swap entry is invalid due to
> unknown reason, and this lead to invalid swap_info_struct. Excessive log

Hi Wupeng,

What is the kernel version you are using? If it's another bug causing
this invalid swap entry, we should fix that bug instead, not
workaround it.

This looks kind of similar to another PATCH & Bug report, corrupted
page table or swap entry:
https://lore.kernel.org/linux-mm/e223b0e6ba2f4924984b1917cc717bd5@honor.com/

Might be the same kernel bug? Gaoxu mentioned the bug was observed on
Kernel 6.6.30 (android version), and neither of these two workarounds
will fix it completely, the invalid value could cause many other
issues too. We definitely need to find out the root cause.

> printing can fill up the prioritized log space, leading to the purging of
> originally valid logs and hindering problem troubleshooting. To make this
> more robust, kill this task.
>
> Signed-off-by: Ma Wupeng <mawupeng1@...wei.com>
> ---
>  include/linux/swap.h | 1 +
>  mm/memory.c          | 9 ++++++++-
>  mm/swapfile.c        | 2 +-
>  3 files changed, 10 insertions(+), 2 deletions(-)
>
> diff --git a/include/linux/swap.h b/include/linux/swap.h
> index b13b72645db3..0fa39cf66bc4 100644
> --- a/include/linux/swap.h
> +++ b/include/linux/swap.h
> @@ -508,6 +508,7 @@ struct backing_dev_info;
>  extern int init_swap_address_space(unsigned int type, unsigned long nr_pages);
>  extern void exit_swap_address_space(unsigned int type);
>  extern struct swap_info_struct *get_swap_device(swp_entry_t entry);
> +struct swap_info_struct *_swap_info_get(swp_entry_t entry);
>  sector_t swap_folio_sector(struct folio *folio);
>
>  static inline void put_swap_device(struct swap_info_struct *si)
> diff --git a/mm/memory.c b/mm/memory.c
> index b4d3d4893267..2d36e5a644d1 100644
> --- a/mm/memory.c
> +++ b/mm/memory.c
> @@ -4365,8 +4365,15 @@ vm_fault_t do_swap_page(struct vm_fault *vmf)
>
>         /* Prevent swapoff from happening to us. */
>         si = get_swap_device(entry);
> -       if (unlikely(!si))
> +       if (unlikely(!si)) {
> +               if (unlikely(!_swap_info_get(entry)))
> +                       /*
> +                        * return VM_FAULT_SIGBUS for invalid swap entry to
> +                        * avoid infinite #PF.
> +                        */
> +                       ret = VM_FAULT_SIGBUS;

This could lead to VM_FAULT_SIGBUS on swapoff. After swapoff
get_swap_device will return NULL.