Commit ae94264e authored by Minchan Kim's avatar Minchan Kim Committed by Linus Torvalds
Browse files

zram: fix null dereference of handle 

In testing I found handle passed to zs_map_object in __zram_bvec_read is
NULL so eh kernel goes oops in pin_object().

The reason is there is no routine to check the slot's freeing after
getting the slot's lock.  This patch fixes it.

[minchan@kernel.org: v2]
  Link: http://lkml.kernel.org/r/1505887347-10881-1-git-send-email-minchan@kernel.org
Link: http://lkml.kernel.org/r/1505788488-26723-1-git-send-email-minchan@kernel.org


Fixes: 1f7319c7 ("zram: partial IO refactoring")
Signed-off-by: default avatarMinchan Kim <minchan@kernel.org>
Reviewed-by: default avatarSergey Senozhatsky <sergey.senozhatsky.work@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent a872eb21

drivers/block/zram/zram_drv.c

+12 −24
Original line number Diff line number Diff line
@@ -766,27 +766,6 @@ static void zram_slot_unlock(struct zram *zram, u32 index) 
	bit_spin_unlock(ZRAM_ACCESS, &zram->table[index].value);

}



static bool zram_same_page_read(struct zram *zram, u32 index,

				struct page *page,

				unsigned int offset, unsigned int len)

{

	zram_slot_lock(zram, index);

	if (unlikely(!zram_get_handle(zram, index) ||

			zram_test_flag(zram, index, ZRAM_SAME))) {

		void *mem;



		zram_slot_unlock(zram, index);

		mem = kmap_atomic(page);

		zram_fill_page(mem + offset, len,

					zram_get_element(zram, index));

		kunmap_atomic(mem);

		return true;

	}

	zram_slot_unlock(zram, index);



	return false;

}



static void zram_meta_free(struct zram *zram, u64 disksize)

{

	size_t num_pages = disksize >> PAGE_SHIFT;
@@ -884,11 +863,20 @@ static int __zram_bvec_read(struct zram *zram, struct page *page, u32 index, 
		zram_slot_unlock(zram, index);

	}



	if (zram_same_page_read(zram, index, page, 0, PAGE_SIZE))

		return 0;



	zram_slot_lock(zram, index);

	handle = zram_get_handle(zram, index);

	if (!handle || zram_test_flag(zram, index, ZRAM_SAME)) {

		unsigned long value;

		void *mem;



		value = handle ? zram_get_element(zram, index) : 0;

		mem = kmap_atomic(page);

		zram_fill_page(mem, PAGE_SIZE, value);

		kunmap_atomic(mem);

		zram_slot_unlock(zram, index);

		return 0;

	}



	size = zram_get_obj_size(zram, index);



	src = zs_map_object(zram->mem_pool, handle, ZS_MM_RO);

CRA Git | Maintained and supported by SUSTech CRA and CCSE