From nobody Fri Jun 19 17:02:51 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E4F1DC433F5 for ; Fri, 1 Apr 2022 07:28:58 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1343881AbiDAHap (ORCPT ); Fri, 1 Apr 2022 03:30:45 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48896 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233257AbiDAHan (ORCPT ); Fri, 1 Apr 2022 03:30:43 -0400 Received: from szxga02-in.huawei.com (szxga02-in.huawei.com [45.249.212.188]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 426FC62BE6 for ; Fri, 1 Apr 2022 00:28:54 -0700 (PDT) Received: from canpemm500002.china.huawei.com (unknown [172.30.72.54]) by szxga02-in.huawei.com (SkyGuard) with ESMTP id 4KVBYn5N7QzDqCs; Fri, 1 Apr 2022 15:26:37 +0800 (CST) Received: from huawei.com (10.175.124.27) by canpemm500002.china.huawei.com (7.192.104.244) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2308.21; Fri, 1 Apr 2022 15:28:52 +0800 From: Miaohe Lin To: CC: , , Subject: [PATCH] mm/swapfile: unuse_pte can map random data if swap read fails Date: Fri, 1 Apr 2022 15:29:26 +0800 Message-ID: <20220401072926.45051-1-linmiaohe@huawei.com> X-Mailer: git-send-email 2.23.0 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Originating-IP: [10.175.124.27] X-ClientProxiedBy: dggems701-chm.china.huawei.com (10.3.19.178) To canpemm500002.china.huawei.com (7.192.104.244) X-CFilter-Loop: Reflected Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" There is a bug in unuse_pte(): when swap page happens to be unreadable, page filled with random data is mapped into user address space. The fix is to check for PageUptodate and fail swapoff in case of error. Signed-off-by: Miaohe Lin --- mm/swapfile.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/mm/swapfile.c b/mm/swapfile.c index 63c61f8b2611..e72a35de7a0f 100644 --- a/mm/swapfile.c +++ b/mm/swapfile.c @@ -1795,6 +1795,10 @@ static int unuse_pte(struct vm_area_struct *vma, pmd= _t *pmd, ret =3D 0; goto out; } + if (unlikely(!PageUptodate(page))) { + ret =3D -EIO; + goto out; + } =20 dec_mm_counter(vma->vm_mm, MM_SWAPENTS); inc_mm_counter(vma->vm_mm, MM_ANONPAGES); --=20 2.23.0