Re: [PATCH 1/2] zram: fix out-of-bounds access in writeback_store()
Sergey Senozhatsky <[email protected]>
| Newsgroups | gmane.linux.block,gmane.linux.kernel,gmane.linux.kernel.stable |
|---|---|
| Message-ID | <[email protected]> |
On (26/08/04 14:59), Longlong Xia wrote:
> writeback_store() calculates the table scan bounds before taking
> dev_lock. A reset followed by reconfiguration with a smaller disksize
> can therefore replace zram->table while writeback_store() is waiting for
> the lock. Once it acquires the lock, it sees an initialized device but
> scans the new table using the old upper bound, resulting in an
> out-of-bounds access.
>
> Calculate the number of pages while holding dev_lock so the scan bound
> matches the table protected by the lock.
>
> Fixes: a939888ec38b ("zram: support idle/huge page writeback")
> Cc: <[email protected]>
> Assisted-by: Codex:gpt-5.6-sol
> Signed-off-by: Longlong Xia <[email protected]>
Reviewed-by: Sergey Senozhatsky <[email protected]>