kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-08 18:57:22 +00:00
Code Issues Releases Packages Activity
linux/drivers/block/zram
History
Cunlong Li 732fd9f0b9 zram: fix use-after-free in zram_bvec_write_partial() 
zram_read_page() picks the sync or async backing device read path based on
whether the parent bio is NULL.  zram_bvec_write_partial() passes its
parent bio down, so for ZRAM_WB slots the read is dispatched
asynchronously and zram_read_page() returns 0 while the bio is still in
flight.  The caller then runs memcpy_from_bvec(), zram_write_page() and
__free_page() on the buffer, leaving the async read to write into a freed
page.

zram_bvec_read_partial() was switched to NULL in commit 4e3c87b942
("zram: fix synchronous reads") for the same reason; the write_partial
counterpart was missed.

Link: https://lore.kernel.org/20260528-zram-v3-1-cab86eef8764@gmail.com
Fixes: 8e654f8fbf ("zram: read page from backing device")
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Sergey Senozhatsky <senozhatsky@chromium.org>
Signed-off-by: Cunlong Li <shenxiaogll@gmail.com>
Cc: Jens Axboe <axboe@kernel.dk>
Cc: Minchan Kim <minchan@kernel.org>
Cc: Yisheng Xie <xieyisheng1@huawei.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
History 2026-06-03 16:25:50 -07:00
..
backend_842.c zram: move immutable comp params away from per-CPU context 2024-09-09 16:39:10 -07:00
backend_842.h zram: add 842 compression backend support 2024-09-09 16:39:08 -07:00
backend_deflate.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
backend_deflate.h zram: add zlib compression backend support 2024-09-09 16:39:08 -07:00
backend_lz4.c zram: optimize LZ4 dictionary compression performance 2026-04-05 13:53:30 -07:00
backend_lz4.h zram: add lz4 compression backend support 2024-09-09 16:39:07 -07:00
backend_lz4hc.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
backend_lz4hc.h zram: add lz4hc compression backend support 2024-09-09 16:39:07 -07:00
backend_lzo.c zram: move immutable comp params away from per-CPU context 2024-09-09 16:39:10 -07:00
backend_lzo.h zram: add lzo and lzorle compression backends support 2024-09-09 16:39:07 -07:00
backend_lzorle.c zram: move immutable comp params away from per-CPU context 2024-09-09 16:39:10 -07:00
backend_lzorle.h zram: add lzo and lzorle compression backends support 2024-09-09 16:39:07 -07:00
backend_zstd.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
backend_zstd.h zram: add zstd compression backend support 2024-09-09 16:39:08 -07:00
Kconfig zram: ZRAM_DEF_COMP should depend on ZRAM 2024-11-11 17:22:27 -08:00
Makefile zram: add 842 compression backend support 2024-09-09 16:39:08 -07:00
zcomp.c zram: use statically allocated compression algorithm names 2026-04-05 13:53:07 -07:00
zcomp.h zram: use statically allocated compression algorithm names 2026-04-05 13:53:07 -07:00
zram_drv.c zram: fix use-after-free in zram_bvec_write_partial() 2026-06-03 16:25:50 -07:00
zram_drv.h zram: drop ->num_active_comps 2026-04-05 13:53:24 -07:00