No description
  • C 98.2%
  • Assembly 1%
  • Makefile 0.3%
  • Shell 0.2%
  • Python 0.1%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Ritesh Harjani ca3f8dcd6d iomap: Fix negative assignment to unsigned sis->pages in iomap_swapfile_activate
[ Upstream commit 5808fecc572391867fcd929662b29c12e6d08d81 ]

In case if isi.nr_pages is 0, we are making sis->pages (which is
unsigned int) a huge value in iomap_swapfile_activate() by assigning -1.
This could cause a kernel crash in kernel v4.18 (with below signature).
Or could lead to unknown issues on latest kernel if the fake big swap gets
used.

Fix this issue by returning -EINVAL in case of nr_pages is 0, since it
is anyway a invalid swapfile. Looks like this issue will be hit when
we have pagesize < blocksize type of configuration.

I was able to hit the issue in case of a tiny swap file with below
test script.
https://raw.githubusercontent.com/riteshharjani/LinuxStudy/master/scripts/swap-issue.sh

kernel crash analysis on v4.18
==============================
On v4.18 kernel, it causes a kernel panic, since sis->pages becomes
a huge value and isi.nr_extents is 0. When 0 is returned it is
considered as a swapfile over NFS and SWP_FILE is set (sis->flags |= SWP_FILE).
Then when swapoff was getting called it was calling a_ops->swap_deactivate()
if (sis->flags & SWP_FILE) is true. Since a_ops->swap_deactivate() is
NULL in case of XFS, it causes below panic.

Panic signature on v4.18 kernel:
=======================================
root@qemu:/home/qemu# [ 8291.723351] XFS (loop2): Unmounting Filesystem
[ 8292.123104] XFS (loop2): Mounting V5 Filesystem
[ 8292.132451] XFS (loop2): Ending clean mount
[ 8292.263362] Adding 4294967232k swap on /mnt1/test/swapfile.  Priority:-2 extents:1 across:274877906880k
[ 8292.277834] Unable to handle kernel paging request for instruction fetch
[ 8292.278677] Faulting instruction address: 0x00000000
cpu 0x19: Vector: 400 (Instruction Access) at [c0000009dd5b7ad0]
    pc: 0000000000000000
    lr: c0000000003eb9dc: destroy_swap_extents+0xfc/0x120
    sp: c0000009dd5b7d50
   msr: 8000000040009033
  current = 0xc0000009b6710080
  paca    = 0xc00000003ffcb280   irqmask: 0x03   irq_happened: 0x01
    pid   = 5604, comm = swapoff
Linux version 4.18.0 (riteshh@xxxxxxx) (gcc version 8.4.0 (Ubuntu 8.4.0-1ubuntu1~18.04)) #57 SMP Wed Mar 3 01:33:04 CST 2021
enter ? for help
[link register   ] c0000000003eb9dc destroy_swap_extents+0xfc/0x120
[c0000009dd5b7d50] c0000000025a7058 proc_poll_event+0x0/0x4 (unreliable)
[c0000009dd5b7da0] c0000000003f0498 sys_swapoff+0x3f8/0x910
[c0000009dd5b7e30] c00000000000bbe4 system_call+0x5c/0x70
Exception: c01 (System Call) at 00007ffff7d208d8

Signed-off-by: Ritesh Harjani <riteshh@linux.ibm.com>
[djwong: rework the comment to provide more details]
Reviewed-by: Darrick J. Wong <djwong@kernel.org>
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-04-07 14:47:38 +02:00
arch x86/mem_encrypt: Correct physical address calculation in __set_clr_pte_enc() 2021-03-30 14:35:29 +02:00
block block: recalculate segment count for multi-segment discards correctly 2021-03-30 14:35:28 +02:00
certs certs: Fix blacklist flag type confusion 2021-03-04 10:26:29 +01:00
crypto crypto: x86 - Regularize glue function prototypes 2021-03-20 10:39:47 +01:00
Documentation KVM: arm64: Reject VM creation when the default IPA size is unsupported 2021-03-17 17:03:57 +01:00
drivers xen-blkback: don't leak persistent grants from xen_blkbk_map() 2021-03-30 14:35:30 +02:00
fs iomap: Fix negative assignment to unsigned sis->pages in iomap_swapfile_activate 2021-04-07 14:47:38 +02:00
include can: dev: Move device back to init netns on owning netns delete 2021-03-30 14:35:29 +02:00
init fgraph: Initialize tracing_graph_pause at task creation 2021-02-10 09:25:29 +01:00
ipc ipc/util.c: sysvipc_find_ipc() incorrectly updates position index 2020-05-20 08:20:16 +02:00
kernel module: harden ELF info handling 2021-04-07 14:47:38 +02:00
lib PCI: Fix pci_register_io_range() memory leak 2021-03-17 17:03:44 +01:00
LICENSES
mm hugetlbfs: hugetlb_fault_mutex_hash() cleanup 2021-03-30 14:35:19 +02:00
net rpc: fix NULL dereference on kmalloc failure 2021-04-07 14:47:38 +02:00
samples samples, bpf: Add missing munmap in xdpsock 2021-03-17 17:03:33 +01:00
scripts ftrace: Have recordmcount use w8 to read relp->r_info in arm64_is_fake_mcount 2021-03-09 11:09:39 +01:00
security integrity: double check iint_cache was initialized 2021-03-30 14:35:24 +02:00
sound ALSA: hda: ignore invalid NHLT table 2021-03-30 14:35:20 +02:00
tools perf auxtrace: Fix auxtrace queue conflict 2021-03-30 14:35:28 +02:00
usr initramfs: restore default compression behavior 2020-04-08 09:08:38 +02:00
virt KVM: arm64: Ensure I-cache isolation between vcpus of a same VM 2021-03-17 17:03:57 +01:00
.clang-format
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore
.mailmap
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS Documentation/llvm: add documentation on building w/ Clang/LLVM 2020-08-26 10:40:46 +02:00
Makefile Linux 5.4.109 2021-03-30 14:35:30 +02:00
README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.