CVE-2023-53623 — mm/swap: fix swap_info_struct race between swapoff and get_swap_pages()

Affected: Linux

In the Linux kernel, the following vulnerability has been resolved:

mm/swap: fix swap_info_struct race between swapoff and get_swap_pages()

The si->lock must be held when deleting the si from the available list. Otherwise, another thread can re-add the si to the available list, which can lead to memory corruption. The only place we have found where this happens is in the swapoff path. This case can be described as below:

core 0 core 1 swapoff

del_from_avail_list(si) waiting

try lock si->lock acquire swap_avail_lock and re-add si into swap_avail_head

acquire si->lock but missing si already being added again, and continuing to clear SWP_WRITEOK, etc.

It can be easily found that a massive warning messages can be triggered inside get_swap_pages() by some special cases, for example, we call madvise(MADV_PAGEOUT) on blocks of touched memory concurrently, meanwhile, run much swapon-swapoff operations (e.g. stress-ng-swap).

However, in the worst case, panic can be caused by the above scene. In swapoff(), the memory used by si could be kept in swap_info[] after turning off a swap. This means memory corruption will not be caused immediately until allocated and reset for a new swap in the swapon path. A panic message caused: (with CONFIG_PLIST_DEBUG enabled)

------------[ cut here ]------------ top: 00000000e58a3003, n: 0000000013e75cda, p: 000000008cd4451a prev: 0000000035b1…

Most recent entries from all

CVE-2023-53623 — mm/swap: fix swap_info_struct race between swapoff and get_swap_pages()