Re: [PATCH] mm: swap_cgroup: fix NULL deref in lookup_swap_cgroup_id on swapless host
Sasha Levin <[email protected]>
| Newsgroups | org.kernel.vger.cgroups,org.kernel.vger.linux-kernel,org.kernel.vger.stable,org.kvack.linux-mm |
|---|---|
| Message-ID | <[email protected]> |
> Yes, we would like to backport this patch to the 6.6.y stable tree.
> We have encountered the same issue on a product running the Android GKI 6.6 kernel.
This is not a 6.6.y fix. The NULL deref is only reachable through the
batching added by bea67dcc5eea ("mm: attempt to batch free swap entries
for zap_pte_range()"), which is v6.12 and newer. 6.6.y has no
swap_pte_batch() at all, so the exit_mmap -> zap_pte_range ->
lookup_swap_cgroup_id path you are hitting does not exist there and the
guard would be dead code.
Your oops is on Android GKI 6.6, which carries the batching backport
downstream - that is the tree that should carry this fix, alongside the
commit that makes it reachable.
--
Thanks,
Sasha