Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 041aba19 authored by Seth Jennings's avatar Seth Jennings Committed by Greg Kroah-Hartman
Browse files

staging: zcache: fix memory corruption bug 



This patch fixes a bug where the zv code writes before the allocated
buffer, resulting in system memory corruption. This was introduced
during the switch from xvmalloc to zsmalloc.

Signed-off-by: default avatarSeth Jennings <sjenning@linux.vnet.ibm.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 843c666d

drivers/staging/zcache/zcache-main.c

+2 −4
Original line number Original line Diff line number Diff line
@@ -701,7 +701,6 @@ static struct zv_hdr *zv_create(struct zs_pool *pool, uint32_t pool_id, 
	u32 size = clen + sizeof(struct zv_hdr);

	u32 size = clen + sizeof(struct zv_hdr);

	int chunks = (size + (CHUNK_SIZE - 1)) >> CHUNK_SHIFT;

	int chunks = (size + (CHUNK_SIZE - 1)) >> CHUNK_SHIFT;

	void *handle = NULL;

	void *handle = NULL;

	char *buf;





	BUG_ON(!irqs_disabled());

	BUG_ON(!irqs_disabled());

	BUG_ON(chunks >= NCHUNKS);

	BUG_ON(chunks >= NCHUNKS);
@@ -710,14 +709,13 @@ static struct zv_hdr *zv_create(struct zs_pool *pool, uint32_t pool_id, 
		goto out;

		goto out;

	atomic_inc(&zv_curr_dist_counts[chunks]);

	atomic_inc(&zv_curr_dist_counts[chunks]);

	atomic_inc(&zv_cumul_dist_counts[chunks]);

	atomic_inc(&zv_cumul_dist_counts[chunks]);

	zv = (struct zv_hdr *)((char *)cdata - sizeof(*zv));

	zv = zs_map_object(pool, handle);

	zv->index = index;

	zv->index = index;

	zv->oid = *oid;

	zv->oid = *oid;

	zv->pool_id = pool_id;

	zv->pool_id = pool_id;

	zv->size = clen;

	zv->size = clen;

	SET_SENTINEL(zv, ZVH);

	SET_SENTINEL(zv, ZVH);

	buf = zs_map_object(pool, handle);

	memcpy((char *)zv + sizeof(struct zv_hdr), cdata, clen);

	memcpy(buf, zv, clen + sizeof(*zv));

	zs_unmap_object(pool, handle);

	zs_unmap_object(pool, handle);

out:

out:

	return handle;

	return handle;