+ mm-zswap-validate-dlen-and-normalize-comp_ret-on-compression-success.patch added to mm-unstable branch

+ mm-zswap-validate-dlen-and-normalize-comp_ret-on-compression-success.patch added to mm-unstable branch

[Andrew Morton]

The patch titled
     Subject: mm/zswap: validate dlen and normalize comp_ret on compression success
has been added to the -mm mm-unstable branch.  Its filename is
     mm-zswap-validate-dlen-and-normalize-comp_ret-on-compression-success.patch

This patch will shortly appear at
     https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patches/mm-zswap-validate-dlen-and-normalize-comp_ret-on-compression-success.patch

This patch will later appear in the mm-unstable branch at
    git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

Before you just go and hit "reply", please:
   a) Consider who else should be cc'ed
   b) Prefer to cc a suitable mailing list as well
   c) Ideally: find the original patch on the mailing list and do a
      reply-to-all to that, adding suitable additional cc's

*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***

The -mm tree is included into linux-next via various
branches at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there most days

------------------------------------------------------
From: Suseendran Bhaskaran <suseendranb@google.com>
Subject: mm/zswap: validate dlen and normalize comp_ret on compression success
Date: Thu, 22 Oct 2026 23:27:33 +0000

In zswap_compress(), dlen is only meaningful when compression succeeds
(!comp_ret), as compressors do not consistently set req->dlen on error
(e.g. zstd, 842, and qat set dlen = 0; lz4, lz4hc, lzo, lzo-rle,
deflate, and iaa leave dlen at PAGE_SIZE; hisi_zip sets dlen to the
hardware-reported produced bytes).

When !comp_ret and dlen == PAGE_SIZE with zswap writeback disabled,
zswap_compress() sets comp_ret to -EINVAL instead of -ENOSPC,
miscounting the page under reject_compress_fail instead of
reject_compress_poor.

When !comp_ret, set comp_ret = -ENOSPC if dlen == PAGE_SIZE, or
comp_ret = -EINVAL if WARN_ON_ONCE(!dlen || dlen > PAGE_SIZE). This
allows simplifying the failure check to 'if (comp_ret)' and dropping
the ternary assignment in the writeback-disabled path.

Link: https://lore.kernel.org/20261022232734.496064-1-suseendranb@google.com
Fixes: dca4437a5861 ("mm/zswap: store <PAGE_SIZE compression failed page as-is")
Signed-off-by: Suseendran Bhaskaran <suseendranb@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Acked-by: Yosry Ahmed <yosry@kernel.org>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Nhat Pham <nphamcs@gmail.com>
Cc: Chengming Zhou <chengming.zhou@linux.dev>
---

 mm/zswap.c |    9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

--- a/mm/zswap.c~mm-zswap-validate-dlen-and-normalize-comp_ret-on-compression-success
+++ a/mm/zswap.c
@@ -918,6 +918,12 @@ static bool zswap_compress(struct folio
 	comp_ret = crypto_wait_req(crypto_acomp_compress(comp_ctx->areq.req),
 				   &comp_ctx->areq.wait);
 	dlen = comp_ctx->areq.req->dlen;
+	if (!comp_ret) {
+		if (dlen == PAGE_SIZE)
+			comp_ret = -ENOSPC;
+		else if (WARN_ON_ONCE(!dlen || dlen > PAGE_SIZE))
+			comp_ret = -EINVAL;
+	}
 
 	/*
 	 * If a page cannot be compressed into a size smaller than PAGE_SIZE,
@@ -926,11 +932,10 @@ static bool zswap_compress(struct folio
 	 * only adds metadata overhead.  swap_writeout() will put the page back
 	 * to the active LRU list in the case.
 	 */
-	if (comp_ret || !dlen || dlen >= PAGE_SIZE) {
+	if (comp_ret) {
 		rcu_read_lock();
 		if (!mem_cgroup_zswap_writeback_enabled(folio_memcg(folio))) {
 			rcu_read_unlock();
-			comp_ret = comp_ret ? comp_ret : -EINVAL;
 			goto unlock;
 		}
 		rcu_read_unlock();
_

Patches currently in -mm which might be from suseendranb@google.com are

mm-zswap-validate-dlen-and-normalize-comp_ret-on-compression-success.patch