[PATCH] do_swap_page() can map random data if swap read fails

[PATCH] do_swap_page() can map random data if swap read fails

[Kirill Korotaev]

[-- Attachment #1: Type: text/plain, Size: 330 bytes --]

against 2.6.12-rc4

There is a bug in do_swap_page(): when swap page happens to be 
unreadable, page filled with random data is mapped into user
address space.
The fix is to check for PageUptodate and send SIGBUS in case of error.

Signed-Off-By: Kirill Korotaev <dev@sw.ru>
Signed-Off-By: Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>

[-- Attachment #2: diff-mainstream-swaperrs-20050429 --]
[-- Type: text/plain, Size: 907 bytes --]

--- ./mm/memory.c.swaperr	2005-05-10 16:10:40.000000000 +0400
+++ ./mm/memory.c	2005-05-10 18:09:12.000000000 +0400
@@ -1701,12 +1701,13 @@ static int do_swap_page(struct mm_struct
 	spin_lock(&mm->page_table_lock);
 	page_table = pte_offset_map(pmd, address);
 	if (unlikely(!pte_same(*page_table, orig_pte))) {
-		pte_unmap(page_table);
-		spin_unlock(&mm->page_table_lock);
-		unlock_page(page);
-		page_cache_release(page);
 		ret = VM_FAULT_MINOR;
-		goto out;
+		goto out_nomap;
+	}
+
+	if (unlikely(!PageUptodate(page))) {
+		ret = VM_FAULT_SIGBUS;
+		goto out_nomap;
 	}
 
 	/* The page isn't present yet, go ahead with the fault. */
@@ -1741,6 +1742,12 @@ static int do_swap_page(struct mm_struct
 	spin_unlock(&mm->page_table_lock);
 out:
 	return ret;
+out_nomap:
+	pte_unmap(page_table);
+	spin_unlock(&mm->page_table_lock);
+	unlock_page(page);
+	page_cache_release(page);
+	goto out;
 }
 
 /*

Re: [PATCH] do_swap_page() can map random data if swap read fails

[Hugh Dickins]

On Wed, 11 May 2005, Kirill Korotaev wrote:

> against 2.6.12-rc4
> 
> There is a bug in do_swap_page(): when swap page happens to be unreadable,
> page filled with random data is mapped into user
> address space.
> The fix is to check for PageUptodate and send SIGBUS in case of error.
> 
> Signed-Off-By: Kirill Korotaev <dev@sw.ru>
> Signed-Off-By: Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>

Ah, yes, that surprised me years ago, but I forgot all about it.

Acked-by: Hugh Dickins <hugh@veritas.com>