linux-kernel - Re: [RFC PATCH] mm/page_alloc: fix use-after-free in swap due to stale page data after split

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CABXGCsO3XcXt5GDae7d74ynC6P6G2gLw3ZrwAYvSQ3PwP0mGXA@mail.gmail.com>
Date: Tue, 3 Feb 2026 12:14:16 +0500
From: Mikhail Gavrilov <mikhail.v.gavrilov@...il.com>
To: Kairui Song <ryncsn@...il.com>
Cc: Linux Memory Management List <linux-mm@...ck.org>, 
	Linux List Kernel Mailing <linux-kernel@...r.kernel.org>, Andrew Morton <akpm@...ux-foundation.org>, 
	Vlastimil Babka <vbabka@...e.cz>, chrisl@...nel.org, Hugh Dickins <hughd@...gle.com>
Subject: Re: [RFC PATCH] mm/page_alloc: fix use-after-free in swap due to
 stale page data after split_page()

On Tue, Feb 3, 2026 at 1:21 AM Mikhail Gavrilov
<mikhail.v.gavrilov@...il.com> wrote:
>
> diff --git a/mm/swapfile.c b/mm/swapfile.c
> index 46d2008e4b99..f131494d4262 100644
> --- a/mm/swapfile.c
> +++ b/mm/swapfile.c
> @@ -3859,10 +3859,11 @@ int add_swap_count_continuation(swp_entry_t
> entry, gfp_t gfp_mask)
>
>         spin_lock(&si->cont_lock);
>         /*
> -        * Page allocation does not initialize the page's lru field,
> -        * but it does always reset its private field.
> +        * Page allocation does not initialize the page's lru field, and
> +        * vmalloc pages from split_page() may have stale page->private.
> +        * Check for SWP_CONTINUED not just non-zero.
>          */
> -       if (!page_private(head)) {
> +       if (page_private(head) != SWP_CONTINUED) {
>                 BUG_ON(count & COUNT_CONTINUED);
>                 INIT_LIST_HEAD(&head->lru);
>                 set_page_private(head, SWP_CONTINUED);
>

Sorry, I sent the previous message before completing testing. The
swapfile.c fix doesn't actually work.

The problem is that stale page->private could accidentally equal
SWP_CONTINUED (32), so we can't distinguish between a legitimately
initialized page and stale data that happens to be 32. In testing, the
crash still occurred with the swapfile.c-only fix.

The correct fix is in split_page() - clear page->private for tail pages:

diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index cbf758e27aa2..3604a00e2118 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -3122,8 +3122,14 @@ void split_page(struct page *page, unsigned int order)
        VM_BUG_ON_PAGE(PageCompound(page), page);
        VM_BUG_ON_PAGE(!page_count(page), page);

-       for (i = 1; i < (1 << order); i++)
+       for (i = 1; i < (1 << order); i++) {
                set_page_refcounted(page + i);
+               /*
+                * Tail pages may have stale page->private from buddy
+                * allocator or previous use. Clear it.
+                */
+               set_page_private(page + i, 0);
+       }
        split_page_owner(page, order, 0);
        pgalloc_tag_split(page_folio(page), order, 0);
        split_page_memcg(page, order);


Note: only clearing page->private, not touching page->lru (to avoid
breaking split_free_page() which may have head on a list).

Tested for 7+ hours with stress test cycling swapon/swapoff on 8GB
zram under memory pressure - no crashes.

-- 
Best Regards,
Mike Gavrilov.