linux-kernel - Forwarded: [PATCH] mm, swap: fix cgroup V1 leak after removal of swap cache bypass

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <696531d6.050a0220.eaf7.00bf.GAE@google.com>
Date: Mon, 12 Jan 2026 09:39:34 -0800
From: syzbot <syzbot+d97580a8cceb9b03c13e@...kaller.appspotmail.com>
To: linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com
Subject: Forwarded: [PATCH] mm, swap: fix cgroup V1 leak after removal of swap
 cache bypass

For archival purposes, forwarding an incoming command email to
linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com.

***

Subject: [PATCH] mm, swap: fix cgroup V1 leak after removal of swap cache bypass
Author: ryncsn@...il.com

From: Kairui Song <kasong@...cent.com>

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master

Recent patch is causing a memory cgruop V1 swap leak, this patch should
fix that [1].

Link: https://lore.kernel.org/all/CAMgjq7CMsAMZZJL1=a=EtfWCOuDFE62RKR_0hUdPC4H+QF5GfQ@mail.gmail.com/ [1]
Reported-by: syzbot+d97580a8cceb9b03c13e@...kaller.appspotmail.com
Link: https://lore.kernel.org/all/6960c2f0.050a0220.1c677c.03be.GAE@google.com/
Signed-off-by: Kairui Song <kasong@...cent.com>
---
 mm/vmscan.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mm/vmscan.c b/mm/vmscan.c
index f35afc5093dc..a0e3f51de749 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -760,8 +760,8 @@ static int __remove_mapping(struct address_space *mapping, struct folio *folio,
 
 		if (reclaimed && !mapping_exiting(mapping))
 			shadow = workingset_eviction(folio, target_memcg);
-		__swap_cache_del_folio(ci, folio, swap, shadow);
 		memcg1_swapout(folio, swap);
+		__swap_cache_del_folio(ci, folio, swap, shadow);
 		swap_cluster_unlock_irq(ci);
 	} else {
 		void (*free_folio)(struct folio *);
-- 
2.52.0