linux-kernel - Re: [PATCH 3/4] zram: implement deduplication in zram

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 28 Mar 2017 09:28:15 +0900
From:   Joonsoo Kim <iamjoonsoo.kim@....com>
To:     Sergey Senozhatsky <sergey.senozhatsky@...il.com>
Cc:     Andrew Morton <akpm@...ux-foundation.org>,
        Minchan Kim <minchan@...nel.org>, linux-kernel@...r.kernel.org,
        kernel-team@....com
Subject: Re: [PATCH 3/4] zram: implement deduplication in zram

On Thu, Mar 23, 2017 at 10:40:59PM +0900, Sergey Senozhatsky wrote:
> 
> Hello Joonsoo,
> 
> On (03/16/17 11:46), js1304@...il.com wrote:
> [..]
> > +static bool zram_entry_put(struct zram *zram, struct zram_meta *meta,
> > +			struct zram_entry *entry, bool populated)
> > +{
> > +	struct zram_hash *hash;
> > +	u32 checksum;
> > +
> > +	if (!populated)
> > +		goto free;
> > +
> > +	checksum = entry->checksum;
> > +	hash = &meta->hash[checksum % meta->hash_size];
> > +
> > +	spin_lock(&hash->lock);
> > +	entry->refcount--;
> > +	if (!entry->refcount) {
> > +		populated = false;
> > +		rb_erase(&entry->rb_node, &hash->rb_root);
> > +		RB_CLEAR_NODE(&entry->rb_node);
> > +	}
> > +	spin_unlock(&hash->lock);
> > +
> > +free:
> > +	if (!populated)
> > +		zram_entry_free(zram, meta, entry);
> > +
> > +	return populated;
> > +}
> 
> [ 2935.830100] BUG: unable to handle kernel NULL pointer dereference at 0000000000000154
> [ 2935.830106] IP: zram_entry_put+0x15/0xbb [zram]
> [ 2935.830107] PGD 4063aa067 
> [ 2935.830108] P4D 4063aa067 
> [ 2935.830108] PUD 19d426067 
> [ 2935.830109] PMD 0 
> 
> [ 2935.830110] Oops: 0000 [#1] PREEMPT SMP
> [ 2935.830111] Modules linked in: lzo zram(-) zsmalloc mousedev nls_iso8859_1 nls_cp437 vfat fat psmouse serio_raw atkbd libps2 coretemp hwmon iwlmvm crc32c_intel i2c_i801 r8169 iwlwifi lpc_ich mii mfd_core ie31200_edac edac_core thermal i8042 serio wmi evdev acpi_cpufreq sd_mod
> [ 2935.830127] CPU: 3 PID: 1599 Comm: rmmod Tainted: G        W       4.11.0-rc3-next-20170323-dbg-00012-gdda44065c67c-dirty #155
> [ 2935.830128] task: ffff8804061c14c0 task.stack: ffff8801f7908000
> [ 2935.830130] RIP: 0010:zram_entry_put+0x15/0xbb [zram]
> [ 2935.830131] RSP: 0018:ffff8801f790bdc0 EFLAGS: 00010246
> [ 2935.830132] RAX: 0000000000000000 RBX: ffff88041cdbfce0 RCX: 0000000000000001
> [ 2935.830132] RDX: ffff880405f4cdb8 RSI: ffff88041cdbfce0 RDI: 0000000000000000
> [ 2935.830133] RBP: ffff8801f790bde8 R08: ffffffffffffff80 R09: 00000000000000ff
> [ 2935.830134] R10: ffff8801f790bd90 R11: 0000000000000000 R12: 0000000000000000
> [ 2935.830134] R13: ffff88041cdbfce0 R14: ffff88041cdbfd00 R15: ffff88041cdbfce0
> [ 2935.830135] FS:  00007fb350b62b40(0000) GS:ffff88042fac0000(0000) knlGS:0000000000000000
> [ 2935.830136] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 2935.830137] CR2: 0000000000000154 CR3: 00000002d3f53000 CR4: 00000000001406e0
> [ 2935.830137] Call Trace:
> [ 2935.830139]  zram_meta_free+0x50/0x7e [zram]
> [ 2935.830141]  zram_reset_device+0xd2/0xe5 [zram]
> [ 2935.830142]  zram_remove+0x9f/0xf1 [zram]
> [ 2935.830143]  ? zram_remove+0xf1/0xf1 [zram]
> [ 2935.830145]  zram_remove_cb+0x11/0x15 [zram]
> [ 2935.830148]  idr_for_each+0x3b/0x87
> [ 2935.830149]  destroy_devices+0x2a/0x56 [zram]
> [ 2935.830150]  zram_exit+0x9/0x6f6 [zram]
> [ 2935.830153]  SyS_delete_module+0xf1/0x181
> [ 2935.830156]  entry_SYSCALL_64_fastpath+0x18/0xad
> [ 2935.830157] RIP: 0033:0x7fb3502659b7
> [ 2935.830158] RSP: 002b:00007fff90ca5468 EFLAGS: 00000202 ORIG_RAX: 00000000000000b0
> [ 2935.830159] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fb3502659b7
> [ 2935.830159] RDX: 000000000000000a RSI: 0000000000000800 RDI: 0000000002187208
> [ 2935.830160] RBP: 0000000000000000 R08: 00007fff90ca43e1 R09: 000000000000000a
> [ 2935.830161] R10: 0000000000000892 R11: 0000000000000202 R12: 00000000021871a0
> [ 2935.830162] R13: 00007fff90ca4450 R14: 00000000021871a0 R15: 0000000002186010
> [ 2935.830163] Code: 1e 6f fb ff 4c 89 e7 e8 9e 05 f5 e0 48 89 d8 5b 41 5c 41 5d 5d c3 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 41 55 49 89 f5 41 54 53 <83> bf 54 01 00 00 00 48 89 d3 75 0e 48 8b 7e 08 48 89 d6 e8 0b 
> [ 2935.830184] RIP: zram_entry_put+0x15/0xbb [zram] RSP: ffff8801f790bdc0
> [ 2935.830184] CR2: 0000000000000154
> [ 2935.838309] ---[ end trace f7f95fd0ed6c72a0 ]---

Hello,

Thanks for reporting.
I have noticed this bug and fixed it in version 2.

Thanks.