mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/
synced 2026-11-08 18:57:22 +00:00
ce4be9e430
Parallel concurrent writes to the same zram index result in leaked
zsmalloc handles. Schematically we can have something like this:
CPU0 CPU1
zram_slot_lock()
zs_free(handle)
zram_slot_lock()
zram_slot_lock()
zs_free(handle)
zram_slot_lock()
compress compress
handle = zs_malloc() handle = zs_malloc()
zram_slot_lock
zram_set_handle(handle)
zram_slot_lock
zram_slot_lock
zram_set_handle(handle)
zram_slot_lock
Either CPU0 or CPU1 zsmalloc handle will leak because zs_free() is done
too early. In fact, we need to reset zram entry right before we set its
new handle, all under the same slot lock scope.
Link: https://lkml.kernel.org/r/20250909045150.635345-1-senozhatsky@chromium.org
Fixes:
|
History
|
|
|---|---|---|
| .. | ||
| backend_842.c | ||
| backend_842.h | ||
| backend_deflate.c | ||
| backend_deflate.h | ||
| backend_lz4.c | ||
| backend_lz4.h | ||
| backend_lz4hc.c | ||
| backend_lz4hc.h | ||
| backend_lzo.c | ||
| backend_lzo.h | ||
| backend_lzorle.c | ||
| backend_lzorle.h | ||
| backend_zstd.c | ||
| backend_zstd.h | ||
| Kconfig | ||
| Makefile | ||
| zcomp.c | ||
| zcomp.h | ||
| zram_drv.c | ||
| zram_drv.h | ||