Re: [PATCH v5 12/19] mm, swap: let swapoff destroy xswap devices by name

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [High] mm, swap: ERR_PTR(-ENOENT) dereference in sys_swapoff() on
  empty path
--

commit ae71026877d501dba7d03d0b98df83479aa3a6b8
Author: Baoquan He <hebaoquan@kylinos.cn>

mm, swap: let swapoff destroy xswap devices by name

This commit teaches swapoff() to fall back to destroying an xswap device
when file_open_name() fails with -ENOENT and the name matches
"xswap<digits>".

> diff --git a/mm/swapfile.c b/mm/swapfile.c
> index cb53f9415de8f..7b1d16226b7bb 100644
> --- a/mm/swapfile.c
> +++ b/mm/swapfile.c

[ ... ]

> @@ -3513,8 +3520,21 @@ SYSCALL_DEFINE1(swapoff, const char __user *, specialfile)
>  
>  	CLASS(filename, pathname)(specialfile);
>  	victim = file_open_name(pathname, O_RDWR|O_LARGEFILE, 0);
> -	if (IS_ERR(victim))
> -		return PTR_ERR(victim);
> +	if (IS_ERR(victim)) {
> +		/*
> +		 * An xswap device has no file, so /proc/swaps shows a name
> +		 * that cannot be opened. Accept it here so swapoff -a works.
> +		 * Only a missing name is taken for a device; a real file or
> +		 * directory that failed for another reason must not match.
> +		 */
> +		if (PTR_ERR(victim) != -ENOENT)
> +			return PTR_ERR(victim);
> +
> +		err = xswap_destroy_by_name(pathname->name);

[Severity: High]
Can this dereference an error pointer in pathname->name when specialfile
is an empty string?

When specialfile is "", getname() returns ERR_PTR(-ENOENT) in pathname,
and file_open_name() -> do_file_open() returns ERR_CAST(pathname) in
victim.  Because PTR_ERR(victim) is -ENOENT, swapoff() then evaluates
pathname->name without checking IS_ERR(pathname) and faults on
ERR_PTR(-ENOENT).

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261109055455.536925-1-baoquan.he@linux.dev?part=12