kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-08 18:57:22 +00:00
Code Issues Releases Packages Activity
linux/drivers/block/zram
History
Richard Chang bf62f69574 zram: fix use-after-free in zram_writeback_endio 
A crash was observed in zram_writeback_endio due to a NULL pointer
dereference in wake_up.  The root cause is a race condition between the
bio completion handler (zram_writeback_endio) and the writeback task.

In zram_writeback_endio, wake_up() is called on &wb_ctl->done_wait after
releasing wb_ctl->done_lock.  This creates a race window where the
writeback task can see num_inflight become 0, return, and free wb_ctl
before zram_writeback_endio calls wake_up().

CPU 0 (zram_writeback_endio)     CPU 1 (writeback_store)
============================     ============================
                                 zram_writeback_slots
                                   zram_submit_wb_request
                                   zram_submit_wb_request
                                   wait_event(wb_ctl->done_wait)
spin_lock(&wb_ctl->done_lock);
list_add(&req->entry, &wb_ctl->done_reqs);
spin_unlock(&wb_ctl->done_lock);
wake_up(&wb_ctl->done_wait);
                                   zram_complete_done_reqs
spin_lock(&wb_ctl->done_lock);
list_add(&req->entry, &wb_ctl->done_reqs);
spin_unlock(&wb_ctl->done_lock);
                                   while (num_inflight) > 0)
                                     spin_lock(&wb_ctl->done_lock);
                                     list_del(&req->entry);
                                     spin_unlock(&wb_ctl->done_lock);
                                     // num_inflight becomes 0
                                     atomic_dec(num_inflight);

                                 // Leave zram_writeback_slots
                                 // Free wb_ctl
                                 release_wb_ctl(wb_ctl);
// UAF crash!
wake_up(&wb_ctl->done_wait);

This patch fixes this race by using RCU.  By protecting wb_ctl with
rcu_read_lock() in zram_writeback_endio and using kfree_rcu() to free it,
we ensure that wb_ctl remains valid during the execution of
zram_writeback_endio.

Link: https://lore.kernel.org/20260512074918.2606208-1-richardycc@google.com
Fixes: f405066a1f ("zram: introduce writeback bio batching")
Signed-off-by: Richard Chang <richardycc@google.com>
Suggested-by: Sergey Senozhatsky <senozhatsky@chromium.org>
Suggested-by: Minchan Kim <minchan@kernel.org>
Acked-by: Sergey Senozhatsky <senozhatsky@chromium.org>
Acked-by: Minchan Kim <minchan@kernel.org>
Cc: Brian Geffon <bgeffon@google.com>
Cc: Jens Axboe <axboe@kernel.dk>
Cc: Martin Liu <liumartin@google.com>
Cc: wang wei <a929244872@163.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
History 2026-05-21 19:06:11 -07:00
..
backend_842.c zram: move immutable comp params away from per-CPU context 2024-09-09 16:39:10 -07:00
backend_842.h zram: add 842 compression backend support 2024-09-09 16:39:08 -07:00
backend_deflate.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
backend_deflate.h zram: add zlib compression backend support 2024-09-09 16:39:08 -07:00
backend_lz4.c zram: optimize LZ4 dictionary compression performance 2026-04-05 13:53:30 -07:00
backend_lz4.h zram: add lz4 compression backend support 2024-09-09 16:39:07 -07:00
backend_lz4hc.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
backend_lz4hc.h zram: add lz4hc compression backend support 2024-09-09 16:39:07 -07:00
backend_lzo.c zram: move immutable comp params away from per-CPU context 2024-09-09 16:39:10 -07:00
backend_lzo.h zram: add lzo and lzorle compression backends support 2024-09-09 16:39:07 -07:00
backend_lzorle.c zram: move immutable comp params away from per-CPU context 2024-09-09 16:39:10 -07:00
backend_lzorle.h zram: add lzo and lzorle compression backends support 2024-09-09 16:39:07 -07:00
backend_zstd.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
backend_zstd.h zram: add zstd compression backend support 2024-09-09 16:39:08 -07:00
Kconfig zram: ZRAM_DEF_COMP should depend on ZRAM 2024-11-11 17:22:27 -08:00
Makefile zram: add 842 compression backend support 2024-09-09 16:39:08 -07:00
zcomp.c zram: use statically allocated compression algorithm names 2026-04-05 13:53:07 -07:00
zcomp.h zram: use statically allocated compression algorithm names 2026-04-05 13:53:07 -07:00
zram_drv.c zram: fix use-after-free in zram_writeback_endio 2026-05-21 19:06:11 -07:00
zram_drv.h zram: drop ->num_active_comps 2026-04-05 13:53:24 -07:00