From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7EB812F83A2 for ; Mon, 16 Mar 2026 14:52:26 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773672746; cv=none; b=uaqeRaDORx/q+W2XUB/oYqTwuOVC1hLtXwvPR+Bzfj0VcKIaoFLShiCSIkAoofIn3+n/o0w4SYaR6X8QDO6SxrTdlgxwgBCrVTr4JoY7DwlvECzK0MJvMxgawJzw1daovexUrE5kJur92TgIjdwKHX5MkYVsfFx4MQc77Qs1wSQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773672746; c=relaxed/simple; bh=nXa/crsZunzyPoYFm5OwusAkjLu41BbPXctb3NCGNNc=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=lpnrblX39cqu6MAnhLEMRh92gA+RV/FwJvPedXDglMG2NDYVkLQP6blQsvXJdmaiNZd1eCuFEf0RtX4pBi/306bYfVD3CajZBMIo+nCCSNG+0NqfanHTQ1ACoURYyQQCwbmvWRu2z/gJncgriiGVWNQFwYHa2feeJOHz7Zow0sc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=DfW4y7ce; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="DfW4y7ce" Received: by smtp.kernel.org (Postfix) with ESMTPSA id A74D3C19421; Mon, 16 Mar 2026 14:52:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1773672746; bh=nXa/crsZunzyPoYFm5OwusAkjLu41BbPXctb3NCGNNc=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=DfW4y7cetHIXd5DCFdCHyjUkLHw9LwgdUVV78AtJvz8zsz40mkyVR5D1LWvPNsrH0 +qB0jmsQut4TQ3jvWrrQu7KYlmwbpEAtY+Prx4Q/y08727ihuYMhjyPgS2TztiWN6E N3W5LLxJyZuv7yYyqJkmU3NrvIw+GPjbCu7OEXHHU3RwNdwrfN9YKWP7nkgWICj4GM ZeBccBEWeQb6OJC8DraTxtFSQA8X+aKoeGZvfc9fIMOfJqumD+/KfRXMPmwdCJDA9E JFw5mlJ+stGcbGNWHWIsmPHu6mJ3ozJX8FBRi3F8AhoezyMCgI6zJiMskCSmCdFM7D rcEHikoXEIVQA== Date: Mon, 16 Mar 2026 14:52:24 +0000 From: Yosry Ahmed To: "Lorenzo Stoakes (Oracle)" Cc: Andrew Morton , Johannes Weiner , Nhat Pham , Chengming Zhou , linux-mm@kvack.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH mm-hotfixes] mm/zswap: add missing kunmap_local() Message-ID: References: <20260316140122.339697-1-ljs@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20260316140122.339697-1-ljs@kernel.org> On Mon, Mar 16, 2026 at 02:01:22PM +0000, Lorenzo Stoakes (Oracle) wrote: > Commit e2c3b6b21c77 ("mm: zswap: use SG list decompression APIs from > zsmalloc") updated zswap_decompress() to use the scatterwalk API to copy > data for uncompressed pages. > > In doing so, it mapped kernel memory locally for 32-bit kernels using > kmap_local_folio(), however it never unmapped this memory. > > This resulted in the linked syzbot report where a BUG_ON() is triggered due > to leaking the kmap slot. > > This patch fixes the issue by explicitly unmapping the established kmap. > > Reported-by: syzbot+fe426bef95363177631d@syzkaller.appspotmail.com > Closes: https://lore.kernel.org/all/69b75e2c.050a0220.12d28.015a.GAE@google.com > Fixes: e2c3b6b21c77 ("mm: zswap: use SG list decompression APIs from zsmalloc") > Signed-off-by: Lorenzo Stoakes (Oracle) Oh thanks for catching that, not sure how I ended up doing that tbh.. Anyway, LGTM: Acked-by: Yosry Ahmed > --- > mm/zswap.c | 7 ++++++- > 1 file changed, 6 insertions(+), 1 deletion(-) > > diff --git a/mm/zswap.c b/mm/zswap.c > index e6ec3295bdb0..499520f65ff0 100644 > --- a/mm/zswap.c > +++ b/mm/zswap.c > @@ -942,9 +942,14 @@ static bool zswap_decompress(struct zswap_entry *entry, struct folio *folio) > > /* zswap entries of length PAGE_SIZE are not compressed. */ > if (entry->length == PAGE_SIZE) { > + void *dst; > + > WARN_ON_ONCE(input->length != PAGE_SIZE); > - memcpy_from_sglist(kmap_local_folio(folio, 0), input, 0, PAGE_SIZE); > + > + dst = kmap_local_folio(folio, 0); > + memcpy_from_sglist(dst, input, 0, PAGE_SIZE); > dlen = PAGE_SIZE; > + kunmap_local(dst); > } else { > sg_init_table(&output, 1); > sg_set_folio(&output, folio, PAGE_SIZE, 0); > -- > 2.53.0