linux-kernel - Re: [PATCH] zram: avoid kunmap

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <5452395C.6030500@redhat.com>
Date:	Thu, 30 Oct 2014 09:13:00 -0400
From:	Jerome Marchand <jmarchan@...hat.com>
To:	Weijie Yang <weijie.yang@...sung.com>,
	"'Minchan Kim'" <minchan@...nel.org>
CC:	"'Andrew Morton'" <akpm@...ux-foundation.org>,
	"'Sergey Senozhatsky'" <sergey.senozhatsky@...il.com>,
	"'Dan Streetman'" <ddstreet@...e.org>,
	"'Nitin Gupta'" <ngupta@...are.org>,
	"'Weijie Yang'" <weijie.yang.kh@...il.com>,
	"'Linux-MM'" <linux-mm@...ck.org>,
	"'linux-kernel'" <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] zram: avoid kunmap_atomic a NULL pointer

On 10/30/2014 02:20 AM, Weijie Yang wrote:
> zram could kunmap_atomic a NULL pointer in a rare situation:
> a zram page become a full-zeroed page after a partial write io.
> The current code doesn't handle this case and kunmap_atomic a
> NULL porinter, which panic the kernel.
> 
> This patch fixes this issue.
> 
> Signed-off-by: Weijie Yang <weijie.yang@...sung.com>

Acked-by: Jerome Marchand <jmarchan@...hat.com>

> ---
>  drivers/block/zram/zram_drv.c |    3 ++-
>  1 files changed, 2 insertions(+), 1 deletions(-)
> 
> diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
> index 2ad0b5b..3920ee4 100644
> --- a/drivers/block/zram/zram_drv.c
> +++ b/drivers/block/zram/zram_drv.c
> @@ -560,7 +560,8 @@ static int zram_bvec_write(struct zram *zram, struct bio_vec *bvec, u32 index,
>  	}
>  
>  	if (page_zero_filled(uncmem)) {
> -		kunmap_atomic(user_mem);
> +		if (user_mem)
> +			kunmap_atomic(user_mem);
>  		/* Free memory associated with this sector now. */
>  		bit_spin_lock(ZRAM_ACCESS, &meta->table[index].value);
>  		zram_free_page(zram, index);
> 



Download attachment "signature.asc" of type "application/pgp-signature" (474 bytes)