Re: [PATCH] mm: Fix possible NULL pointer dereference in __swap_duplicate
From: Andrew Morton
Date: Wed Feb 12 2025 - 19:18:26 EST
On Wed, 12 Feb 2025 03:13:46 +0000 gaoxu <gaoxu2@xxxxxxxxx> wrote:
> swp_swap_info() may return null; it is necessary to check the return value
> to avoid NULL pointer dereference. The code for other calls to
> swp_swap_info() includes checks, and __swap_duplicate() should also
> include checks.
Actually very few of the swp_swap_info() callers check for a NULL return.
> The reason why swp_swap_info() returns NULL is unclear; it may be due to
> CPU cache issues or DDR bit flips.
Quite possibly it's a kernel bug.
> The probability of this issue is very
> small, and the stack info we encountered is as follows:
> Unable to handle kernel NULL pointer dereference at virtual address
> 0000000000000058
>
> ...
>
> --- a/mm/swapfile.c
> +++ b/mm/swapfile.c
> @@ -3521,6 +3521,8 @@ static int __swap_duplicate(swp_entry_t entry, unsigned char usage, int nr)
> int err, i;
>
> si = swp_swap_info(entry);
> + if (unlikely(!si))
> + return -EINVAL;
>
> offset = swp_offset(entry);
> VM_WARN_ON(nr > SWAPFILE_CLUSTER - offset % SWAPFILE_CLUSTER);
OK, I guess avoiding the crash is good. But please let's include a
WARN so that we can perhaps fix the bug, if one is there.