From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id C17C9C677C4 for ; Wed, 11 Jun 2025 08:27:25 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 4AD6E6B008A; Wed, 11 Jun 2025 04:27:25 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 4370B6B008C; Wed, 11 Jun 2025 04:27:25 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 325406B0092; Wed, 11 Jun 2025 04:27:25 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0012.hostedemail.com [216.40.44.12]) by kanga.kvack.org (Postfix) with ESMTP id 12CAC6B008A for ; Wed, 11 Jun 2025 04:27:25 -0400 (EDT) Received: from smtpin01.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay09.hostedemail.com (Postfix) with ESMTP id B39378045F for ; Wed, 11 Jun 2025 08:27:24 +0000 (UTC) X-FDA: 83542440408.01.255E36E Received: from dggsgout11.his.huawei.com (dggsgout11.his.huawei.com [45.249.212.51]) by imf19.hostedemail.com (Postfix) with ESMTP id 34F941A0006 for ; Wed, 11 Jun 2025 08:27:19 +0000 (UTC) Authentication-Results: imf19.hostedemail.com; dkim=none; dmarc=none; spf=pass (imf19.hostedemail.com: domain of shikemeng@huaweicloud.com designates 45.249.212.51 as permitted sender) smtp.mailfrom=shikemeng@huaweicloud.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1749630443; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=jJDax0nMNmUl3jU0lozRlYTYH1CDyJX5PqXvHhwQ8Q8=; b=c0RpkoM1mOD2lQmBetkXqrJQrXlowXA2JoC5uqjBQuzhmkz4SFqlNJXzFa9v9/T2B5qI/C LRLED2+mB9CMo0c/kNfp1Hb1CKRKFfdweTxduxiQVXXgZ++M/eq02DWi68AY2FuESjWEsF 3GDK93a2wp63VRD+BkdgsPOZysVa0Uc= ARC-Authentication-Results: i=1; imf19.hostedemail.com; dkim=none; dmarc=none; spf=pass (imf19.hostedemail.com: domain of shikemeng@huaweicloud.com designates 45.249.212.51 as permitted sender) smtp.mailfrom=shikemeng@huaweicloud.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1749630443; a=rsa-sha256; cv=none; b=6g4jgd5lrgkDOmKdd1hlkbP0ZLFdIgm0Tp0WK/ASlC6phCZVSUvC5ypnq+CqTnwaBSHmWP j0QZfczb2xZ2ZUSBiccvPg8w+jfJXqSHzdtMGwHEoGbzCRBFYiGjcBJNAcMuUdWorZSQFq r+jh5h8tJsb33mGpYQ7yrEpZbMT+EGw= Received: from mail.maildlp.com (unknown [172.19.163.216]) by dggsgout11.his.huawei.com (SkyGuard) with ESMTPS id 4bHJg839rbzYQvX3 for ; Wed, 11 Jun 2025 16:27:16 +0800 (CST) Received: from mail02.huawei.com (unknown [10.116.40.75]) by mail.maildlp.com (Postfix) with ESMTP id 6FBE21A08FC for ; Wed, 11 Jun 2025 16:27:15 +0800 (CST) Received: from [10.174.99.169] (unknown [10.174.99.169]) by APP2 (Coremail) with SMTP id Syh0CgBXYGPhPUloYQ41PA--.27979S2; Wed, 11 Jun 2025 16:27:15 +0800 (CST) Subject: Re: [PATCH 3/4] mm: swap: fix potensial buffer overflow in setup_clusters() To: Kairui Song Cc: akpm@linux-foundation.org, bhe@redhat.com, hannes@cmpxchg.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org References: <20250522122554.12209-1-shikemeng@huaweicloud.com> <20250522122554.12209-4-shikemeng@huaweicloud.com> From: Kemeng Shi Message-ID: Date: Wed, 11 Jun 2025 16:27:02 +0800 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.9.1 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-CM-TRANSID:Syh0CgBXYGPhPUloYQ41PA--.27979S2 X-Coremail-Antispam: 1UD129KBjvJXoW7tF1rtF4xtw43Ar47Aw47urg_yoW8Cw4DpF 1rKas8CF4DJryqkw17Za1DCry3GrnYka9rKa4fJ34akF98WrWIgFy8Kr1Ykr1DKwn5Aryv 9F4DW34Uu3ZYv37anT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUUvjb4IE77IF4wAFF20E14v26r1j6r4UM7CY07I20VC2zVCF04k2 6cxKx2IYs7xG6rWj6s0DM7CIcVAFz4kK6r1j6r18M28lY4IEw2IIxxk0rwA2F7IY1VAKz4 vEj48ve4kI8wA2z4x0Y4vE2Ix0cI8IcVAFwI0_Ar0_tr1l84ACjcxK6xIIjxv20xvEc7Cj xVAFwI0_Gr1j6F4UJwA2z4x0Y4vEx4A2jsIE14v26rxl6s0DM28EF7xvwVC2z280aVCY1x 0267AKxVW0oVCq3wAS0I0E0xvYzxvE52x082IY62kv0487Mc02F40EFcxC0VAKzVAqx4xG 6I80ewAv7VC0I7IYx2IY67AKxVWUJVWUGwAv7VC2z280aVAFwI0_Jr0_Gr1lOx8S6xCaFV Cjc4AY6r1j6r4UM4x0Y48IcVAKI48JMxk0xIA0c2IEe2xFo4CEbIxvr21lc7CjxVAaw2AF wI0_JF0_Jw1l42xK82IYc2Ij64vIr41l4I8I3I0E4IkC6x0Yz7v_Jr0_Gr1lx2IqxVAqx4 xG67AKxVWUJVWUGwC20s026x8GjcxK67AKxVWUGVWUWwC2zVAF1VAY17CE14v26r126r1D MIIYrxkI7VAKI48JMIIF0xvE2Ix0cI8IcVAFwI0_Jr0_JF4lIxAIcVC0I7IYx2IY6xkF7I 0E14v26r1j6r4UMIIF0xvE42xK8VAvwI8IcIk0rVWUJVWUCwCI42IY6I8E87Iv67AKxVWU JVW8JwCI42IY6I8E87Iv6xkF7I0E14v26r4j6r4UJbIYCTnIWIevJa73UjIFyTuYvjxU7I JmUUUUU X-CM-SenderInfo: 5vklyvpphqwq5kxd4v5lfo033gof0z/ X-Rspamd-Queue-Id: 34F941A0006 X-Rspamd-Server: rspam03 X-Rspam-User: X-Stat-Signature: e5bepuofqon8f9jw6pj5qd6kz19s5e9e X-HE-Tag: 1749630439-459951 X-HE-Meta: U2FsdGVkX18XxFeOr9sZ5xVN3yKZ7duLaz5ODQsrqTUioNdxc2FEiilDwK7Z+hOJFlMiKHjXuBHyIAz5wF0qS4RU5yN5q6yvNK13km2mamVJPBdZSMvzHk/RHW1/plWKU2uVt88aKXJpYgy1ZkeBSwxxnw8UT+If8Th2wN7W5tNQHpeWJKuZU88GUU1Mg37B6E8x6y8/LZ6qW/AXBxohSC8fr1ypDGBJw80xyR1IDzW+nvGTriaqWE4d6N7NCafOfOX+gZskjIVA9yxp/2CqPlMAh2EbOXF+o6g37w0DDr7BIxlBOEf11F818qqgL0WYHtN/DqmdbSmOxtV5ZAXCacNvcNijwLvfShDAZC5Vwqhq+LCMOh+g8NSdEao1kXg/MJPWvPlBkmX17PC8AN1F1Q9foZF4ne0Q/BHcEmikOT/Gm8/j6BXZSeK0+29DnE+qkM2CvGu+qZX04mwwubnH63TALvzAn5gkbPLM7SdJUHQ0PA6thDEe5K6bAyJ4J8BtxAug3ZF3bPhPG17KWjirrdEETSwkN5bVt4Hf9pFoVgmw0p/T+19Hh5dBvbhpQG4x/Sqb7alCKmzGySvC+waagcyPxGY4bycSZ7EciHaAOVm9UWGeNLwuJ4zo3eBjW4G+vnKA1I9OlMyXOAgpO9o7Pned3kGJB902o4Fb2VcCY6VaCIlQMlr8fyh0iqYPFDnGwtSPcMYSy2eJxaDbJJkD9MxwSJdgcj69Xk1Jdg/JQDcK6uT2riUTovVySKEx6ez2e+bAT4VKkON9C8ZYEZJUDpkFszK8dU9yTD+HudOsAomQ/wgVW6jInOe28vEKXzPmKSYicTLDuq/4zJrWTqt5SLcEt4Dub/S3UtgU0lXl6eXPwdK5Z4bbJMyMQKyVhpXIptJDbjqrhWM27EjwEsFrDjupDiW9xUyrFGvgAV93rjR2NLlQveS/f5fAvOpzrrzZZEhH9jWjVRr8d57M6OS Wie1mEX5 kuLP6tVN36gsGOK9lMhsEChbyLONf4b/3joX68mj0FlvGBYYChFbsGSz9n488Ltzud8rxhEQJbJzvDM13XKbq0eJv5BkUQ7hejMegmoydZg4npJJdnrvp/8dGHuVJg/2lIUsNbgjiFDGyMGWpub2B52+J4uPSJfx9Ntw2THfV3nk37p94sdI1XkwJPrEpO6myVl84wVBuebpv0uvOJDX1uPGzzMlW8EOjBkEaaqTTItmKJwGWGRUfuorRqMO27oaWzhH3 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: on 5/26/2025 2:44 AM, Kairui Song wrote: > On Thu, May 22, 2025 at 11:32 AM Kemeng Shi wrote: >> >> In setup_swap_map(), we only ensure badpages are in range (0, last_page]. >> As maxpages might be < last_page, setup_clusters() will encounter a >> buffer overflow when a badpage is >= maxpages. >> Only call inc_cluster_info_page() for badpage which is < maxpages to >> fix the issue. >> >> Fixes: b843786b0bd01 ("mm: swapfile: fix SSD detection with swapfile on btrfs") >> Signed-off-by: Kemeng Shi >> --- >> mm/swapfile.c | 10 +++++++--- >> 1 file changed, 7 insertions(+), 3 deletions(-) >> >> diff --git a/mm/swapfile.c b/mm/swapfile.c >> index a82f4ebefca3..63ab9f14b2c6 100644 >> --- a/mm/swapfile.c >> +++ b/mm/swapfile.c >> @@ -3208,9 +3208,13 @@ static struct swap_cluster_info *setup_clusters(struct swap_info_struct *si, >> * and the EOF part of the last cluster. >> */ >> inc_cluster_info_page(si, cluster_info, 0); >> - for (i = 0; i < swap_header->info.nr_badpages; i++) >> - inc_cluster_info_page(si, cluster_info, >> - swap_header->info.badpages[i]); >> + for (i = 0; i < swap_header->info.nr_badpages; i++) { >> + unsigned int page_nr = swap_header->info.badpages[i]; >> + >> + if (page_nr >= maxpages) >> + continue; >> + inc_cluster_info_page(si, cluster_info, page_nr); > > I think we might need a pr_err or pr_warn here, this means mkswap > marked the wrong region as a bad block? Or some fs side things went > wrong. As Baoquan metioned that there is already warning in read_swap_header(). Besides, I think last_page in swap_header already indicates the range which is acceptable to fs and we only need to explicitly handle page_nr which is > last_page. > > >> + } >> for (i = maxpages; i < round_up(maxpages, SWAPFILE_CLUSTER); i++) >> inc_cluster_info_page(si, cluster_info, i); >> >> -- >> 2.30.0 >> >> >