Received-SPF: pass (google.com: domain of linux-kernel+bounces-12306-linux.lists.archive=gmail.com@vger.kernel.org designates 139.178.88.99 as permitted sender) client-ip=139.178.88.99;
Precedence: bulk
MIME-Version: 1.0
References: <20231213-zswap-dstmem-v4-0-f228b059dd89@bytedance.com>
 <20231213-zswap-dstmem-v4-1-f228b059dd89@bytedance.com> <CAGsJ_4wuTZcGurby9h4PU2DwFaiEKB4bxuycaeyz3bPw3jSX3A@mail.gmail.com>
 <af0a03d5-e536-41b7-9ab8-c5985794b7db@bytedance.com> <20231227125853.2dd07cd61f8a8df95042677c@linux-foundation.org>
In-Reply-To: <20231227125853.2dd07cd61f8a8df95042677c@linux-foundation.org>
From: Nhat Pham <nphamcs@gmail.com>
Date: Wed, 27 Dec 2023 15:21:45 -0800
Message-ID: <CAKEwX=PDeez9D8t4WSe2qd753h=06ZSJwQ8TQDv1xLXB0cpn-Q@mail.gmail.com>
Subject: Re: [PATCH v4 1/6] mm/zswap: change dstmem size to one page
To: Andrew Morton <akpm@linux-foundation.org>
Cc: Chengming Zhou <zhouchengming@bytedance.com>, Barry Song <21cnbao@gmail.com>, 
	Seth Jennings <sjenning@redhat.com>, Johannes Weiner <hannes@cmpxchg.org>, 
	Vitaly Wool <vitaly.wool@konsulko.com>, Chris Li <chriscli@google.com>, 
	Yosry Ahmed <yosryahmed@google.com>, Dan Streetman <ddstreet@ieee.org>, linux-kernel@vger.kernel.org, 
	linux-mm@kvack.org, Chris Li <chrisl@kernel.org>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Wed, Dec 27, 2023 at 12:58=E2=80=AFPM Andrew Morton
<akpm@linux-foundation.org> wrote:
>
> On Wed, 27 Dec 2023 14:11:06 +0800 Chengming Zhou <zhouchengming@bytedanc=
e.com> wrote:
>
> > > i remember there was an over-compression case,  that means the compre=
ssed
> > > data can be bigger than the source data. the similar thing is also do=
ne in zram
> > > drivers/block/zram/zcomp.c
> >
> > Right, there is a buffer overflow report[1] that I just +to you.
>
> What does "[1]" refer to?  Is there a bug report about this series?

I think Chengming was referring to this:

https://lore.kernel.org/lkml/0000000000000b05cd060d6b5511@google.com/

Syzkaller/syzbot found an edge case where the page's "compressed" form
was larger than one page, which tripped up the compression code (since
we reduced the compression buffer size to 1 page here).