lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Sat, 25 Oct 2014 17:26:31 +0800 From: Weijie Yang <weijie.yang@...sung.com> To: 'Minchan Kim' <minchan@...nel.org> Cc: 'Andrew Morton' <akpm@...ux-foundation.org>, 'Dan Streetman' <ddstreet@...e.org>, 'Sergey Senozhatsky' <sergey.senozhatsky@...il.com>, 'Nitin Gupta' <ngupta@...are.org>, 'Linux-MM' <linux-mm@...ck.org>, 'linux-kernel' <linux-kernel@...r.kernel.org>, 'Weijie Yang' <weijie.yang.kh@...il.com> Subject: [PATCH 2/2] zram: avoid NULL pointer access when reading mem_used_total There is a rare NULL pointer bug in mem_used_total_show() in concurrent situation, like this: zram is not initialized, process A is a mem_used_total reader which runs periodicity, while process B try to init zram. process A process B access meta, get a NULL value init zram, done init_done() is true access meta->mem_pool, get a NULL pointer BUG This patch fixes this issue. Signed-off-by: Weijie Yang <weijie.yang@...sung.com> --- drivers/block/zram/zram_drv.c | 5 +++-- 1 files changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c index 64dd79a..2ffd7d8 100644 --- a/drivers/block/zram/zram_drv.c +++ b/drivers/block/zram/zram_drv.c @@ -99,11 +99,12 @@ static ssize_t mem_used_total_show(struct device *dev, { u64 val = 0; struct zram *zram = dev_to_zram(dev); - struct zram_meta *meta = zram->meta; down_read(&zram->init_lock); - if (init_done(zram)) + if (init_done(zram)) { + struct zram_meta *meta = zram->meta; val = zs_get_total_pages(meta->mem_pool); + } up_read(&zram->init_lock); return scnprintf(buf, PAGE_SIZE, "%llu\n", val << PAGE_SHIFT); -- 1.7.0.4 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists