linux-kernel - Re: [PATCH] mm: swap: Avoid infinite loop if no valid swap entry found during do_swap

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAMgjq7C7hguzq3DmR3s7=3LNGeaCC8qdmiQvLCZrdkB86=BFFw@mail.gmail.com>
Date: Sat, 22 Feb 2025 16:02:45 +0800
From: Kairui Song <ryncsn@...il.com>
To: mawupeng <mawupeng1@...wei.com>
Cc: akpm@...ux-foundation.org, david@...hat.com, ryan.roberts@....com, 
	chrisl@...nel.org, huang.ying.caritas@...il.com, schatzberg.dan@...il.com, 
	baohua@...nel.org, hanchuanhua@...o.com, willy@...radead.org, 
	gaoxu2@...or.com, linux-mm@...ck.org, linux-kernel@...r.kernel.org, 
	nphamcs@...il.com, yosryahmed@...gle.com
Subject: Re: [PATCH] mm: swap: Avoid infinite loop if no valid swap entry
 found during do_swap_page

On Sat, Feb 22, 2025 at 3:41 PM mawupeng <mawupeng1@...wei.com> wrote:
> On 2025/2/22 15:33, Kairui Song wrote:
> > On Sat, Feb 22, 2025 at 10:56 AM Wupeng Ma <mawupeng1@...wei.com> wrote:
> >>
> >> From: Ma Wupeng <mawupeng1@...wei.com>
> >>
> >> During our test, infinite loop is produced during #PF will lead to infinite
> >> error log as follow:
> >>
> >>    get_swap_device: Bad swap file entry 114000000
> >>
> >> Digging into the source, we found that the swap entry is invalid due to
> >> unknown reason, and this lead to invalid swap_info_struct. Excessive log
> >
> > Hi Wupeng,
> >
> > What is the kernel version you are using? If it's another bug causing
> > this invalid swap entry, we should fix that bug instead, not
> > workaround it.
> >
> > This looks kind of similar to another PATCH & Bug report, corrupted
> > page table or swap entry:
> > https://lore.kernel.org/linux-mm/e223b0e6ba2f4924984b1917cc717bd5@honor.com/
> >
> > Might be the same kernel bug? Gaoxu mentioned the bug was observed on
> > Kernel 6.6.30 (android version), and neither of these two workarounds
> > will fix it completely, the invalid value could cause many other
> > issues too. We definitely need to find out the root cause.
>
> We are having this problem in linux-v5.10, since the log is lost and swap
> is not enabled in this machines, maybe memory corrupted in the pt.

Thanks for the info, that's very strange. Since you didn't even enable
SWAP, it must be something else corrupted the page table I think

> >
> >> printing can fill up the prioritized log space, leading to the purging of
> >> originally valid logs and hindering problem troubleshooting. To make this
> >> more robust, kill this task.
> >>
> >> Signed-off-by: Ma Wupeng <mawupeng1@...wei.com>
> >> ---
> >>  include/linux/swap.h | 1 +
> >>  mm/memory.c          | 9 ++++++++-
> >>  mm/swapfile.c        | 2 +-
> >>  3 files changed, 10 insertions(+), 2 deletions(-)
> >>
> >> diff --git a/include/linux/swap.h b/include/linux/swap.h
> >> index b13b72645db3..0fa39cf66bc4 100644
> >> --- a/include/linux/swap.h
> >> +++ b/include/linux/swap.h
> >> @@ -508,6 +508,7 @@ struct backing_dev_info;
> >>  extern int init_swap_address_space(unsigned int type, unsigned long nr_pages);
> >>  extern void exit_swap_address_space(unsigned int type);
> >>  extern struct swap_info_struct *get_swap_device(swp_entry_t entry);
> >> +struct swap_info_struct *_swap_info_get(swp_entry_t entry);
> >>  sector_t swap_folio_sector(struct folio *folio);
> >>
> >>  static inline void put_swap_device(struct swap_info_struct *si)
> >> diff --git a/mm/memory.c b/mm/memory.c
> >> index b4d3d4893267..2d36e5a644d1 100644
> >> --- a/mm/memory.c
> >> +++ b/mm/memory.c
> >> @@ -4365,8 +4365,15 @@ vm_fault_t do_swap_page(struct vm_fault *vmf)
> >>
> >>         /* Prevent swapoff from happening to us. */
> >>         si = get_swap_device(entry);
> >> -       if (unlikely(!si))
> >> +       if (unlikely(!si)) {
> >> +               if (unlikely(!_swap_info_get(entry)))
> >> +                       /*
> >> +                        * return VM_FAULT_SIGBUS for invalid swap entry to
> >> +                        * avoid infinite #PF.
> >> +                        */
> >> +                       ret = VM_FAULT_SIGBUS;
> >
> > This could lead to VM_FAULT_SIGBUS on swapoff. After swapoff
> > get_swap_device will return NULL.
>
> If swap is off, All swap pages should be swap in as expected, so
> such entry can not trigger do_swap_page?

do_swap_page may get blocked due to some random reason, and then a
concurrent swapoff could swap in the entry and disable the device.
Very unlikely to trigger but in theory possible.