Messages in this thread | | | Date | Mon, 4 Apr 2022 15:37:36 +0200 | Subject | Re: [PATCH] mm/swapfile: unuse_pte can map random data if swap read fails | From | David Hildenbrand <> |
| |
On 01.04.22 09:29, Miaohe Lin wrote: > There is a bug in unuse_pte(): when swap page happens to be unreadable, > page filled with random data is mapped into user address space. The fix > is to check for PageUptodate and fail swapoff in case of error. > > Signed-off-by: Miaohe Lin <linmiaohe@huawei.com> > --- > mm/swapfile.c | 4 ++++ > 1 file changed, 4 insertions(+) > > diff --git a/mm/swapfile.c b/mm/swapfile.c > index 63c61f8b2611..e72a35de7a0f 100644 > --- a/mm/swapfile.c > +++ b/mm/swapfile.c > @@ -1795,6 +1795,10 @@ static int unuse_pte(struct vm_area_struct *vma, pmd_t *pmd, > ret = 0; > goto out; > } > + if (unlikely(!PageUptodate(page))) { > + ret = -EIO; > + goto out; > + }
Yeah, we have the same handling in do_swap_page(), whereby we send a SIGBUS because we're dealing with an actual access.
Interestingly, folio_test_uptodate() states:
"Anonymous and CoW folios are always uptodate."
@Willy, is that true or is the swapin case not documented there?
-- Thanks,
David / dhildenb
| |