In case if isi.nr_pages is 0, we are making sis->pages (which is unsigned int) a huge value in iomap_swapfile_activate() by assigning -1. This could cause a kernel crash in kernel v4.18 (with below signature). This also crashes the upstream kernel with below signature, if the big fake swap gets used. Fix this issue by returning -EINVAL in case of nr_pages is 0, since it is anyway a invalid swapfile. Looks like this issue will be hit when we have blocksize < pagesize type of configuration. I was able to hit the issue in case of a tiny swap file with below test script. https://raw.githubusercontent.com/riteshharjani/LinuxStudy/master/scripts/swap-issue.sh <kernel crash on upstream kernel> =============================== [ 120.682527] XFS (loop2): Mounting V5 Filesystem [ 120.688448] XFS (loop2): Ending clean mount [ 120.690555] xfs filesystem being mounted at /mnt1/test supports timestamps until 2038 (0x7fffffff) [ 120.885793] Adding 4294967232k swap on /mnt1/test/swapfile. Priority:-2 extents:1 across:274877906880k <...> [ 186.068492] __swap_info_get: Bad swap offset entry 00000001 [ 186.071704] __swap_info_get: Bad swap offset entry 00000043 <...> [ 453.756321] Faulting instruction address: 0xc0000000005b6c50 cpu 0x6: Vector: 300 (Data Access) at [c00000002a8b6f80] pc: c0000000005b6c50: __mark_inode_dirty+0x40/0x870 lr: c0000000006435b0: iomap_set_page_dirty+0x170/0x1b0 pid = 4635, comm = stress Linux version 5.12.0-rc1-00021-g23cdd4c7150 (gcc (Ubuntu 8.4.0-1ubuntu1~18.04) iomap_set_page_dirty+0x170/0x1b0 swap_set_page_dirty+0xec/0x140 set_page_dirty+0x1b4/0x2d0 add_to_swap+0x178/0x1d0 shrink_page_list+0xe78/0x2120 shrink_inactive_list+0x2b0/0x640 shrink_lruvec+0x710/0x7b0 shrink_node+0x584/0x8e0 do_try_to_free_pages+0x2f8/0x5d0 <...> kernel crash analysis on v4.18 ============================== On v4.18 kernel, it causes a kernel panic, since sis->pages becomes a huge value and isi.nr_extents is 0. When 0 is returned it is considered as a swapfile over NFS and SWP_FILE is set (sis->flags |= SWP_FILE). Then when swapoff was getting called it was calling a_ops->swap_deactivate() if (sis->flags & SWP_FILE) is true. Since a_ops->swap_deactivate() is NULL in case of XFS, it causes below panic. Panic signature on v4.18 kernel: ======================================= [ 8291.723351] XFS (loop2): Unmounting Filesystem [ 8292.123104] XFS (loop2): Mounting V5 Filesystem [ 8292.132451] XFS (loop2): Ending clean mount [ 8292.263362] Adding 4294967232k swap on /mnt1/test/swapfile. Priority:-2 extents:1 across:274877906880k [ 8292.277834] Unable to handle kernel paging request for instruction fetch [ 8292.278677] Faulting instruction address: 0x00000000 cpu 0x19: Vector: 400 (Instruction Access) at [c0000009dd5b7ad0] pc: 0000000000000000 lr: c0000000003eb9dc: destroy_swap_extents+0xfc/0x120 pid = 5604, comm = swapoff Linux version 4.18.0 (riteshh@xxxxxxx) (gcc version 8.4.0 (Ubuntu 8.4.0-1ubuntu1~18.04)) #57 SMP Wed Mar 3 01:33:04 CST 2021 [link register ] c0000000003eb9dc destroy_swap_extents+0xfc/0x120 [c0000009dd5b7d50] c0000000025a7058 proc_poll_event+0x0/0x4 (unreliable) [c0000009dd5b7da0] c0000000003f0498 sys_swapoff+0x3f8/0x910 [c0000009dd5b7e30] c00000000000bbe4 system_call+0x5c/0x70 --- Exception: c01 (System Call) at 00007ffff7d208d8 Signed-off-by: Ritesh Harjani <riteshh@xxxxxxxxxxxxx> --- fs/iomap/swapfile.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/fs/iomap/swapfile.c b/fs/iomap/swapfile.c index a648dbf6991e..23e44bf97c65 100644 --- a/fs/iomap/swapfile.c +++ b/fs/iomap/swapfile.c @@ -170,6 +170,16 @@ int iomap_swapfile_activate(struct swap_info_struct *sis, return ret; } + /* + * If this swapfile doesn't contain even a single page-aligned + * contiguous range of blocks, reject this useless swapfile to + * prevent confusion later on. + */ + if (isi.nr_pages == 0) { + pr_warn("swapon: Empty swap-file\n"); + return -EINVAL; + } + *pagespan = 1 + isi.highest_ppage - isi.lowest_ppage; sis->max = isi.nr_pages; sis->pages = isi.nr_pages - 1; -- 2.26.2
