Re: [PATCH 1/2] zram: fix out-of-bounds access in writeback_store()
Sergey Senozhatsky <[email protected]> Tue, 4 Aug 2026 17:41:29 +0900
| Newsgroups | org.kernel.vger.linux-block,org.kernel.vger.linux-kernel,org.kernel.vger.stable |
|---|---|
| Message-ID | <[email protected]> |
On (26/08/04 14:59), Longlong Xia wrote:
> writeback_store() calculates the table scan bounds before taking
> dev_lock. A reset followed by reconfiguration with a smaller disksize
> can therefore replace zram->table while writeback_store() is waiting for
> the lock. Once it acquires the lock, it sees an initialized device but
> scans the new table using the old upper bound, resulting in an
> out-of-bounds access.
>
> Calculate the number of pages while holding dev_lock so the scan bound
> matches the table protected by the lock.
>
> Fixes: a939888ec38b ("zram: support idle/huge page writeback")
> Cc: <[email protected]>
> Assisted-by: Codex:gpt-5.6-sol
> Signed-off-by: Longlong Xia <[email protected]>
Reviewed-by: Sergey Senozhatsky <[email protected]>