dect
/
linux-2.6
Archived
13
0
Fork 0
Code Releases Activity

staging: zram: fix invalid memory references during disk write 

Fixes a bug introduced by commit c8f2f0db1 ("zram: Fix handling
of incompressible pages") which caused invalid memory references
during disk write. Invalid references could occur in two cases:
 - Incoming data expands on compression: In this case, reference was
made to kunmap()'ed bio page.
 - Partial (non PAGE_SIZE) write with incompressible data: In this
case, reference was made to a kfree()'ed buffer.

Fixes bug 50081:
https://bugzilla.kernel.org/show_bug.cgi?id=50081

Signed-off-by: Nitin Gupta <ngupta@vflare.org>
Cc: stable <stable@vger.kernel.org>
Reported-by: Mihail Kasadjikov <hamer.mk@gmail.com>
Reported-by: Tomas M <tomas@slax.org>
Reviewed-by: Minchan Kim <minchan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Nitin Gupta 2013-01-02 08:53:41 -08:00 committed by Greg Kroah-Hartman
parent e16a922a27
commit 397c60668a
1 changed files with 24 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

39
drivers/staging/zram/zram_drv.c
View File

@ -265,7 +265,7 @@ out_cleanup:
static int zram_bvec_write(struct zram *zram, struct bio_vec *bvec, u32 index, static int zram_bvec_write(struct zram *zram, struct bio_vec *bvec, u32 index,
int offset) int offset)
{ {
int ret; int ret = 0;
size_t clen; size_t clen;
unsigned long handle; unsigned long handle;
struct page *page; struct page *page;
@ -286,10 +286,8 @@ static int zram_bvec_write(struct zram *zram, struct bio_vec *bvec, u32 index,
goto out; goto out;
} }
ret = zram_decompress_page(zram, uncmem, index); ret = zram_decompress_page(zram, uncmem, index);
if (ret) { if (ret)
kfree(uncmem);
goto out; goto out;
}
} }
/* /*
@ -302,16 +300,18 @@ static int zram_bvec_write(struct zram *zram, struct bio_vec *bvec, u32 index,
user_mem = kmap_atomic(page); user_mem = kmap_atomic(page);
if (is_partial_io(bvec)) if (is_partial_io(bvec)) {
memcpy(uncmem + offset, user_mem + bvec->bv_offset, memcpy(uncmem + offset, user_mem + bvec->bv_offset,
bvec->bv_len); bvec->bv_len);
else kunmap_atomic(user_mem);
user_mem = NULL;
} else {
uncmem = user_mem; uncmem = user_mem;
}
if (page_zero_filled(uncmem)) { if (page_zero_filled(uncmem)) {
kunmap_atomic(user_mem); if (!is_partial_io(bvec))
if (is_partial_io(bvec)) kunmap_atomic(user_mem);
kfree(uncmem);
zram_stat_inc(&zram->stats.pages_zero); zram_stat_inc(&zram->stats.pages_zero);
zram_set_flag(zram, index, ZRAM_ZERO); zram_set_flag(zram, index, ZRAM_ZERO);
ret = 0; ret = 0;
@ -321,9 +321,11 @@ static int zram_bvec_write(struct zram *zram, struct bio_vec *bvec, u32 index,
ret = lzo1x_1_compress(uncmem, PAGE_SIZE, src, &clen, ret = lzo1x_1_compress(uncmem, PAGE_SIZE, src, &clen,
zram->compress_workmem); zram->compress_workmem);
kunmap_atomic(user_mem); if (!is_partial_io(bvec)) {
if (is_partial_io(bvec)) kunmap_atomic(user_mem);
kfree(uncmem); user_mem = NULL;
uncmem = NULL;
}
if (unlikely(ret != LZO_E_OK)) { if (unlikely(ret != LZO_E_OK)) {
pr_err("Compression failed! err=%d\n", ret); pr_err("Compression failed! err=%d\n", ret);
@ -332,8 +334,10 @@ static int zram_bvec_write(struct zram *zram, struct bio_vec *bvec, u32 index,
if (unlikely(clen > max_zpage_size)) { if (unlikely(clen > max_zpage_size)) {
zram_stat_inc(&zram->stats.bad_compress); zram_stat_inc(&zram->stats.bad_compress);
src = uncmem;
clen = PAGE_SIZE; clen = PAGE_SIZE;
src = NULL;
if (is_partial_io(bvec))
src = uncmem;
} }
handle = zs_malloc(zram->mem_pool, clen); handle = zs_malloc(zram->mem_pool, clen);
@ -345,7 +349,11 @@ static int zram_bvec_write(struct zram *zram, struct bio_vec *bvec, u32 index,
} }
cmem = zs_map_object(zram->mem_pool, handle, ZS_MM_WO); cmem = zs_map_object(zram->mem_pool, handle, ZS_MM_WO);
if ((clen == PAGE_SIZE) && !is_partial_io(bvec))
src = kmap_atomic(page);
memcpy(cmem, src, clen); memcpy(cmem, src, clen);
if ((clen == PAGE_SIZE) && !is_partial_io(bvec))
kunmap_atomic(src);
zs_unmap_object(zram->mem_pool, handle); zs_unmap_object(zram->mem_pool, handle);
@ -358,9 +366,10 @@ static int zram_bvec_write(struct zram *zram, struct bio_vec *bvec, u32 index,
if (clen <= PAGE_SIZE / 2) if (clen <= PAGE_SIZE / 2)
zram_stat_inc(&zram->stats.good_compress); zram_stat_inc(&zram->stats.good_compress);
return 0;
out: out:
if (is_partial_io(bvec))
kfree(uncmem);
if (ret) if (ret)
zram_stat64_inc(zram, &zram->stats.failed_writes); zram_stat64_inc(zram, &zram->stats.failed_writes);
return ret; return ret;