linux-kernel - Re: [PATCH] mm/swapfile: validate swap offset in unuse_pte

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CADhLXY6FgG3sdZ1CSSp5X8huFPhyKQ+LKNkd0rbo_-=gV40RoA@mail.gmail.com>
Date: Sat, 6 Dec 2025 17:58:10 +0530
From: Deepanshu Kartikey <kartikey406@...il.com>
To: Kairui Song <ryncsn@...il.com>
Cc: akpm@...ux-foundation.org, chrisl@...nel.org, shikemeng@...weicloud.com, 
	nphamcs@...il.com, bhe@...hat.com, baohua@...nel.org, linux-mm@...ck.org, 
	linux-kernel@...r.kernel.org, YoungJun Park <youngjun.park@....com>, 
	syzbot+d7bc9ec4a100437aa7a2@...kaller.appspotmail.com
Subject: Re: [PATCH] mm/swapfile: validate swap offset in unuse_pte_range()

On Wed, Dec 3, 2025 at 8:24 AM Kairui Song <ryncsn@...il.com> wrote:
> > If softleaf v3 has fixed the underlying issue, I can withdraw this
> > patch. Or if you think a defensive sanity check still has value, I can
> > update the commit message to reflect that it is defensive hardening
> > rather than a fix for an active bug.
>
> A sanity check here is acceptable since swapoff is cold and the
> overhead is hardly visible. No strong opinion on this one.

Hi Kairui,

Thank you for the link and clarification!

I'll study Lorenzo's fix to understand the root cause better.

Since you mentioned a sanity check is acceptable here, should I update
the commit message to frame this as defensive hardening rather than a
bug fix? Something like:

    mm/swapfile: add defensive bounds check in unuse_pte_range()

    Add a sanity check to validate the swap offset is within bounds
    before using it. While there is no known code path that can
    trigger an out-of-bounds offset, this provides defense against
    potential edge cases or memory corruption.

    The overhead is negligible since swapoff is a cold path.

Thanks,
Deepanshu