Commit 4184924a authored Sep 17, 2015 by Luis Henriques Committed by Greg Hackmann Dec 09, 2015

UPSTREAM: zram: fix possible use after free in zcomp_create()



commit 3aaf14da807a4e9931a37f21e4251abb8a67021b upstream.

zcomp_create() verifies the success of zcomp_strm_{multi,single}_create()
through comp->stream, which can potentially be pointing to memory that
was freed if these functions returned an error.

While at it, replace a 'ERR_PTR(-ENOMEM)' by a more generic
'ERR_PTR(error)' as in the future zcomp_strm_{multi,siggle}_create()
could return other error codes.  Function documentation updated
accordingly.

Bug: 25951511

Change-Id: I9346eb152e2b4fb8e1942e2acd6483d488297f94
Fixes: beca3ec7 ("zram: add multi stream functionality")
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
Acked-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
Acked-by: Minchan Kim <minchan@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent f750aea0

drivers/block/zram/zcomp.c

+7 −5

Original line number	Diff line number	Diff line
		@@ -325,12 +325,14 @@ void zcomp_destroy(struct zcomp *comp)
		* allocate new zcomp and initialize it. return compressing
		* backend pointer or ERR_PTR if things went bad. ERR_PTR(-EINVAL)
		* if requested algorithm is not supported, ERR_PTR(-ENOMEM) in
		* case of allocation error.
		* case of allocation error, or any other error potentially
		* returned by functions zcomp_strm_{multi,single}_create.
		*/
		struct zcomp zcomp_create(const char compress, int max_strm)
		{
		struct zcomp *comp;
		struct zcomp_backend *backend;
		int error;

		backend = find_backend(compress);
		if (!backend)
		@@ -342,12 +344,12 @@ struct zcomp zcomp_create(const char compress, int max_strm)

		comp->backend = backend;
		if (max_strm > 1)
		zcomp_strm_multi_create(comp, max_strm);
		error = zcomp_strm_multi_create(comp, max_strm);
		else
		zcomp_strm_single_create(comp);
		if (!comp->stream) {
		error = zcomp_strm_single_create(comp);
		if (error) {
		kfree(comp);
		return ERR_PTR(-ENOMEM);
		return ERR_PTR(error);
		}
		return comp;
		}