Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 397c6066 authored by Nitin Gupta's avatar Nitin Gupta Committed by Greg Kroah-Hartman
Browse files

staging: zram: fix invalid memory references during disk write 

Fixes a bug introduced by commit c8f2f0db ("zram: Fix handling
of incompressible pages") which caused invalid memory references
during disk write. Invalid references could occur in two cases:
 - Incoming data expands on compression: In this case, reference was
made to kunmap()'ed bio page.
 - Partial (non PAGE_SIZE) write with incompressible data: In this
case, reference was made to a kfree()'ed buffer.

Fixes bug 50081:
https://bugzilla.kernel.org/show_bug.cgi?id=50081



Signed-off-by: default avatarNitin Gupta <ngupta@vflare.org>
Cc: stable <stable@vger.kernel.org>
Reported-by: default avatarMihail Kasadjikov <hamer.mk@gmail.com>
Reported-by: default avatarTomas M <tomas@slax.org>
Reviewed-by: default avatarMinchan Kim <minchan@kernel.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent e16a922a

drivers/staging/zram/zram_drv.c

+24 −15
Original line number Diff line number Diff line
@@ -265,7 +265,7 @@ static int zram_bvec_read(struct zram *zram, struct bio_vec *bvec, 
static int zram_bvec_write(struct zram *zram, struct bio_vec *bvec, u32 index,

			   int offset)

{

	int ret;

	int ret = 0;

	size_t clen;

	unsigned long handle;

	struct page *page;
@@ -286,11 +286,9 @@ static int zram_bvec_write(struct zram *zram, struct bio_vec *bvec, u32 index, 
			goto out;

		}

		ret = zram_decompress_page(zram, uncmem, index);

		if (ret) {

			kfree(uncmem);

		if (ret)

			goto out;

	}

	}



	/*

	 * System overwrites unused sectors. Free memory associated
@@ -302,16 +300,18 @@ static int zram_bvec_write(struct zram *zram, struct bio_vec *bvec, u32 index, 


	user_mem = kmap_atomic(page);



	if (is_partial_io(bvec))

	if (is_partial_io(bvec)) {

		memcpy(uncmem + offset, user_mem + bvec->bv_offset,

		       bvec->bv_len);

	else

		kunmap_atomic(user_mem);

		user_mem = NULL;

	} else {

		uncmem = user_mem;

	}



	if (page_zero_filled(uncmem)) {

		if (!is_partial_io(bvec))

			kunmap_atomic(user_mem);

		if (is_partial_io(bvec))

			kfree(uncmem);

		zram_stat_inc(&zram->stats.pages_zero);

		zram_set_flag(zram, index, ZRAM_ZERO);

		ret = 0;
@@ -321,9 +321,11 @@ static int zram_bvec_write(struct zram *zram, struct bio_vec *bvec, u32 index, 
	ret = lzo1x_1_compress(uncmem, PAGE_SIZE, src, &clen,

			       zram->compress_workmem);



	if (!is_partial_io(bvec)) {

		kunmap_atomic(user_mem);

	if (is_partial_io(bvec))

			kfree(uncmem);

		user_mem = NULL;

		uncmem = NULL;

	}



	if (unlikely(ret != LZO_E_OK)) {

		pr_err("Compression failed! err=%d\n", ret);
@@ -332,8 +334,10 @@ static int zram_bvec_write(struct zram *zram, struct bio_vec *bvec, u32 index, 


	if (unlikely(clen > max_zpage_size)) {

		zram_stat_inc(&zram->stats.bad_compress);

		src = uncmem;

		clen = PAGE_SIZE;

		src = NULL;

		if (is_partial_io(bvec))

			src = uncmem;

	}



	handle = zs_malloc(zram->mem_pool, clen);
@@ -345,7 +349,11 @@ static int zram_bvec_write(struct zram *zram, struct bio_vec *bvec, u32 index, 
	}

	cmem = zs_map_object(zram->mem_pool, handle, ZS_MM_WO);



	if ((clen == PAGE_SIZE) && !is_partial_io(bvec))

		src = kmap_atomic(page);

	memcpy(cmem, src, clen);

	if ((clen == PAGE_SIZE) && !is_partial_io(bvec))

		kunmap_atomic(src);



	zs_unmap_object(zram->mem_pool, handle);
@@ -358,9 +366,10 @@ static int zram_bvec_write(struct zram *zram, struct bio_vec *bvec, u32 index, 
	if (clen <= PAGE_SIZE / 2)

		zram_stat_inc(&zram->stats.good_compress);



	return 0;



out:

	if (is_partial_io(bvec))

		kfree(uncmem);



	if (ret)

		zram_stat64_inc(zram, &zram->stats.failed_writes);

	return ret;