syzbot reported a WARNING in __swap_offset_to_cluster() triggered by an invalid swap offset during swapoff: WARNING: CPU: 0 PID: 9861 at mm/swap.h:87 swap_cache_get_folio+0x186/0x200 The issue occurs because unuse_pte_range() extracts a swap entry from a PTE and uses the offset without validating it is within bounds of the swap area. While the existing swp_type() check filters entries for other swap areas, it cannot catch cases where the type bits are valid but the offset is corrupted or stale - for example, due to a race condition during PTE updates or memory corruption. Add validation to ensure offset < si->max before using the swap entry. Reported-by: syzbot+d7bc9ec4a100437aa7a2@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=d7bc9ec4a100437aa7a2 Signed-off-by: Deepanshu Kartikey --- mm/swapfile.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/mm/swapfile.c b/mm/swapfile.c index 46d2008e4b99..fdf358df7116 100644 --- a/mm/swapfile.c +++ b/mm/swapfile.c @@ -2277,6 +2277,8 @@ static int unuse_pte_range(struct vm_area_struct *vma, pmd_t *pmd, continue; offset = swp_offset(entry); + if (offset >= si->max) + continue; pte_unmap(pte); pte = NULL; -- 2.43.0