linux-kernel - Re: [RFC PATCH] mm/page_alloc: fix use-after-free in swap due to stale page data after split

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CABXGCsOXn834-kWPJtwJiX2fMw_oDBkhMR9xVi3Yqu6ez58k+g@mail.gmail.com>
Date: Fri, 30 Jan 2026 19:16:37 +0500
From: Mikhail Gavrilov <mikhail.v.gavrilov@...il.com>
To: Matthew Wilcox <willy@...radead.org>
Cc: Linux Memory Management List <linux-mm@...ck.org>, 
	Linux List Kernel Mailing <linux-kernel@...r.kernel.org>, Andrew Morton <akpm@...ux-foundation.org>, 
	Vlastimil Babka <vbabka@...e.cz>, chrisl@...nel.org, kasong@...cent.com, 
	Hugh Dickins <hughd@...gle.com>
Subject: Re: [RFC PATCH] mm/page_alloc: fix use-after-free in swap due to
 stale page data after split_page()

On Fri, Jan 30, 2026 at 6:59 PM Matthew Wilcox <willy@...radead.org> wrote:
>
> Why add a second loop instead of using the existing one?

You're right, no good reason for a separate loop.
Here's v2:

diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index cbf758e27aa2..306493d76ea4 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -3122,8 +3122,17 @@ void split_page(struct page *page, unsigned int order)
        VM_BUG_ON_PAGE(PageCompound(page), page);
        VM_BUG_ON_PAGE(!page_count(page), page);

-       for (i = 1; i < (1 << order); i++)
+       /*
+        * Split pages may contain stale data from previous use. Initialize
+        * page->private and page->lru which may have LIST_POISON values.
+        */
+       INIT_LIST_HEAD(&page->lru);
+       for (i = 1; i < (1 << order); i++) {
                set_page_refcounted(page + i);
+               set_page_private(page + i, 0);
+               INIT_LIST_HEAD(&page[i].lru);
+       }
+
        split_page_owner(page, order, 0);
        pgalloc_tag_split(page_folio(page), order, 0);
        split_page_memcg(page, order);


Should I send a formal v2 patch?

-- 
Best Regards,
Mike Gavrilov.