kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-24 19:10:26 +00:00
Code Issues Releases Packages Activity
linux/drivers/block
History
Liu Shixin c7ee791e53 zram: fix NULL pointer in comp_algorithm_show() 
commit f364cdeb38 upstream.

LTP reported a NULL pointer dereference as followed:

 CPU: 7 UID: 0 PID: 5995 Comm: cat Kdump: loaded Not tainted 6.12.0-rc6+ #3
 Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015
 pstate: 40400005 (nZcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
 pc : __pi_strcmp+0x24/0x140
 lr : zcomp_available_show+0x60/0x100 [zram]
 sp : ffff800088b93b90
 x29: ffff800088b93b90 x28: 0000000000000001 x27: 0000000000400cc0
 x26: 0000000000000ffe x25: ffff80007b3e2388 x24: 0000000000000000
 x23: ffff80007b3e2390 x22: ffff0004041a9000 x21: ffff80007b3e2900
 x20: 0000000000000000 x19: 0000000000000000 x18: 0000000000000000
 x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000
 x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000
 x11: 0000000000000000 x10: ffff80007b3e2900 x9 : ffff80007b3cb280
 x8 : 0101010101010101 x7 : 0000000000000000 x6 : 0000000000000000
 x5 : 0000000000000040 x4 : 0000000000000000 x3 : 00656c722d6f7a6c
 x2 : 0000000000000000 x1 : ffff80007b3e2900 x0 : 0000000000000000
 Call trace:
  __pi_strcmp+0x24/0x140
  comp_algorithm_show+0x40/0x70 [zram]
  dev_attr_show+0x28/0x80
  sysfs_kf_seq_show+0x90/0x140
  kernfs_seq_show+0x34/0x48
  seq_read_iter+0x1d4/0x4e8
  kernfs_fop_read_iter+0x40/0x58
  new_sync_read+0x9c/0x168
  vfs_read+0x1a8/0x1f8
  ksys_read+0x74/0x108
  __arm64_sys_read+0x24/0x38
  invoke_syscall+0x50/0x120
  el0_svc_common.constprop.0+0xc8/0xf0
  do_el0_svc+0x24/0x38
  el0_svc+0x38/0x138
  el0t_64_sync_handler+0xc0/0xc8
  el0t_64_sync+0x188/0x190

The zram->comp_algs[ZRAM_PRIMARY_COMP] can be NULL in zram_add() if
comp_algorithm_set() has not been called.  User can access the zram device
by sysfs after device_add_disk(), so there is a time window to trigger the
NULL pointer dereference.  Move it ahead device_add_disk() to make sure
when user can access the zram device, it is ready.  comp_algorithm_set()
is protected by zram->init_lock in other places and no such problem.

Link: https://lkml.kernel.org/r/20241108100147.3776123-1-liushixin2@huawei.com
Fixes: 7ac07a26de ("zram: preparation for multi-zcomp support")
Signed-off-by: Liu Shixin <liushixin2@huawei.com>
Reviewed-by: Sergey Senozhatsky <senozhatsky@chromium.org>
Cc: Jens Axboe <axboe@kernel.dk>
Cc: Minchan Kim <minchan@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
[This fix does not backport zram_comp_params_reset which was introduced after
 v6.6, in commit f2bac7ad18 ("zram: introduce zcomp_params structure")]
Signed-off-by: Jianqi Ren <jianqi.ren.cn@windriver.com>
Signed-off-by: He Zhe <zhe.he@windriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2025-03-22 12:50:37 -07:00
..
aoe aoe: fix the potential use-after-free problem in more places 2024-10-10 11:57:53 +02:00
drbd drbd: Add NULL check for net_conf to prevent dereference in state validation 2024-10-04 16:29:52 +02:00
mtip32xx block: replace fmode_t with a block-specific type for block open flags 2023-06-12 08:04:05 -06:00
null_blk null_blk: Fix return value of nullb_device_power_store() 2024-10-10 11:58:09 +02:00
rnbd block/rnbd-srv: Check for unlikely string overflow 2024-02-05 20:14:22 +00:00
xen-blkback block: replace fmode_t with a block-specific type for block open flags 2023-06-12 08:04:05 -06:00
zram zram: fix NULL pointer in comp_algorithm_show() 2025-03-22 12:50:37 -07:00
amiflop.c amiflop: don't call fsync_bdev in FDFMTBEG 2023-08-21 14:35:31 +02:00
ataflop.c block: replace fmode_t with a block-specific type for block open flags 2023-06-12 08:04:05 -06:00
brd.c brd: defer automatic disk creation until module initialization succeeds 2024-12-09 10:31:43 +01:00
floppy.c floppy: call disk_force_media_change when changing the format 2023-08-21 14:35:31 +02:00
Kconfig block: ublk: switch to ioctl command encoding 2023-04-18 20:13:30 -06:00
loop.c loop: don't set QUEUE_FLAG_NOMERGES 2024-10-10 11:57:18 +02:00
Makefile Revert "pktcdvd: remove driver." 2023-01-04 14:44:13 -07:00
n64cart.c block: remove blk_cleanup_disk 2022-06-28 06:33:15 -06:00
nbd.c nbd: don't allow reconnect after disconnect 2025-02-08 09:51:42 +01:00
pktcdvd.c block: replace fmode_t with a block-specific type for block open flags 2023-06-12 08:04:05 -06:00
ps3disk.c block: remove blk_cleanup_disk 2022-06-28 06:33:15 -06:00
ps3vram.c ps3vram: remove bio splitting 2023-01-29 15:18:35 -07:00
rbd.c rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings 2024-08-03 08:54:32 +02:00
rbd_types.h libceph, rbd: replace zero-length array with flexible-array 2020-06-01 13:22:53 +02:00
sunvdc.c block: replace fmode_t with a block-specific type for block open flags 2023-06-12 08:04:05 -06:00
swim.c swim: fix a missing FMODE_ -> BLK_OPEN_ conversion in floppy_open 2023-06-20 07:16:04 -06:00
swim3.c swim3: mark swim3_init() static 2023-08-10 08:32:59 -06:00
swim_asm.S treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
ublk_drv.c ublk: set_params: properly check if parameters can be applied 2025-03-13 12:58:32 +01:00
virtio_blk.c virtio-blk: don't keep queue frozen during system suspend 2025-01-02 10:32:06 +01:00
xen-blkfront.c for-6.5/block-2023-06-23 2023-06-26 12:47:20 -07:00
z2ram.c block: replace fmode_t with a block-specific type for block open flags 2023-06-12 08:04:05 -06:00