CVE-2024-26960: mm: swap: fix race between free_swap_and_cache() and swapoff()

In the Linux kernel, the following vulnerability has been resolved:

mm: swap: fix race between freeswapandcache() and swapoff()

There was previously a theoretical window where swapoff() could run and teardown a swapinfostruct while a call to freeswapandcache() was running in another thread. This could cause, amongst other bad possibilities, swappagetranshugeswapped() (called by freeswapandcache()) to access the freed memory for swapmap.

This is a theoretical problem and I haven't been able to provoke it from a test case. But there has been agreement based on code review that this is possible (see link below).

Fix it by using getswapdevice()/putswapdevice(), which will stall swapoff(). There was an extra check in swapinfoget() to confirm that the swap entry was not free. This isn't present in getswapdevice() because it doesn't make sense in general due to the race between getting the reference and swapoff. So I've added an equivalent check directly in freeswapandcache().

Details of how to provoke one possible issue (thanks to David Hildenbrand for deriving this):

--8<-----

swapentryfree() might be the last user and result in "count == SWAPHASCACHE".

swapoff->trytounuse() will stop as soon as soon as si->inusepages==0.

So the question is: could someone reclaim the folio and turn si->inusepages==0, before we completed swappagetranshugeswapped().

Imagine the following: 2 MiB folio in the swapcache. Only 2 subpages are still references by swap entries.

Process 1 still references subpage 0 via swap entry. Process 2 still references subpage 1 via swap entry.

Process 1 quits. Calls freeswapandcache(). -> count == SWAPHASCACHE [then, preempted in the hypervisor etc.]

Process 2 quits. Calls freeswapandcache(). -> count == SWAPHASCACHE

Process 2 goes ahead, passes swappagetranshugeswapped(), and calls trytoreclaimswap().

trytoreclaimswap()->foliofreeswap()->deletefromswapcache()-> putswapfolio()->freeswapslot()->swapcachefreeentries()-> swapentryfree()->swaprangefree()-> ... WRITEONCE(si->inusepages, si->inusepages - nrentries);

What stops swapoff to succeed after process 2 reclaimed the swap cache but before process1 finished its call to swappagetranshugeswapped()?

--8<-----

— NVD