[PATCH 0/2] zram: fix stale scan bounds after reinitialization

From: Longlong Xia <[email protected]>

Both writeback_store() and read_block_state() derive their table scan
bounds from zram->disksize before acquiring dev_lock. If the device is
reset and reinitialized with a smaller disksize between that read and lock
acquisition, the bound can describe the old table while the scan operates
on the new one. This can lead to out-of-bounds slot accesses.

Move both bound calculations under dev_lock so each bound remains
consistent with the table throughout its scan. Keep the fixes separate
because the affected interfaces originate from different commits and can
be backported independently.

The series has been checked with:

  scripts/checkpatch.pl --strict <patches>
  make M=drivers/block/zram modules

Longlong Xia (2):
  zram: fix out-of-bounds access in writeback_store()
  zram: fix out-of-bounds access in read_block_state()

 drivers/block/zram/zram_drv.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)


base-commit: 848acc8ffe1b7cd5f1bf427b93069becfebc2c9d
-- 
2.43.0