linux-kernel - Re: [PATCH] mm: memcontrol: fix swap counter leak from offline cgroup

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <A4994942-1844-4F51-BF23-08848E069484@linux.dev>
Date: Fri, 7 Mar 2025 10:28:32 +0800
From: Muchun Song <muchun.song@...ux.dev>
To: Johannes Weiner <hannes@...xchg.org>
Cc: Kairui Song <ryncsn@...il.com>,
 Muchun Song <songmuchun@...edance.com>,
 mhocko@...nel.org,
 roman.gushchin@...ux.dev,
 shakeel.butt@...ux.dev,
 akpm@...ux-foundation.org,
 chrisl@...nel.org,
 linux-kernel@...r.kernel.org,
 cgroups@...r.kernel.org,
 linux-mm@...ck.org,
 stable@...r.kernel.org
Subject: Re: [PATCH] mm: memcontrol: fix swap counter leak from offline cgroup



> On Mar 6, 2025, at 22:37, Johannes Weiner <hannes@...xchg.org> wrote:
> 
> On Thu, Mar 06, 2025 at 10:54:12AM +0800, Kairui Song wrote:
>> On Thu, Mar 6, 2025 at 10:32 AM Muchun Song <songmuchun@...edance.com> wrote:
>>> 
>>> The commit 6769183166b3 has removed the parameter of id from
>>> swap_cgroup_record() and get the memcg id from
>>> mem_cgroup_id(folio_memcg(folio)). However, the caller of it
>>> may update a different memcg's counter instead of
>>> folio_memcg(folio). E.g. in the caller of mem_cgroup_swapout(),
>>> @swap_memcg could be different with @memcg and update the counter
>>> of @swap_memcg, but swap_cgroup_record() records the wrong memcg's
>>> ID. When it is uncharged from __mem_cgroup_uncharge_swap(), the
>>> swap counter will leak since the wrong recorded ID. Fix it by
>>> bring the parameter of id back.
>>> 
>>> Fixes: 6769183166b3 ("mm/swap_cgroup: decouple swap cgroup recording and clearing")
>>> Cc: <stable@...r.kernel.org>
>>> Signed-off-by: Muchun Song <songmuchun@...edance.com>
> 
> Acked-by: Johannes Weiner <hannes@...xchg.org>
> 
> Looking at the original commit again, we also should do this:
> 
> ---
> 
> From 2685ca87d73d0c2b91cfd6959e381a40db235119 Mon Sep 17 00:00:00 2001
> From: Johannes Weiner <hannes@...xchg.org>
> Date: Thu, 6 Mar 2025 09:31:42 -0500
> Subject: [PATCH] mm: swap_cgroup: remove double initialization of locals
> 
> Fixes: 6769183166b3 ("mm/swap_cgroup: decouple swap cgroup recording and clearing")
> Signed-off-by: Johannes Weiner <hannes@...xchg.org>

Yes.

Reviewed-by: Muchun Song <muchun.song@...ux.dev>

Thanks.

> ---
> mm/swap_cgroup.c | 3 +--
> 1 file changed, 1 insertion(+), 2 deletions(-)
> 
> diff --git a/mm/swap_cgroup.c b/mm/swap_cgroup.c
> index 1007c30f12e2..de779fed8c21 100644
> --- a/mm/swap_cgroup.c
> +++ b/mm/swap_cgroup.c
> @@ -92,8 +92,7 @@ void swap_cgroup_record(struct folio *folio, unsigned short id,
>  */
> unsigned short swap_cgroup_clear(swp_entry_t ent, unsigned int nr_ents)
> {
> - 	pgoff_t offset = swp_offset(ent);
> - 	pgoff_t end = offset + nr_ents;
> + 	pgoff_t offset, end;
> 	struct swap_cgroup *map;
> 	unsigned short old, iter = 0;
> 
> -- 
> 2.48.1