2023-11-06 20:03:58

by Vasily Averin

[permalink] [raw]
Subject: [PATCH] zram: unsafe zram_get_element call in zram_read_page()

Taken lock is required to access the content of zram entry.

Fixes: 8e19d540d107 ("zram: extend zero pages to same element pages")
Signed-off-by: Vasily Averin <[email protected]>
---
drivers/block/zram/zram_drv.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
index d77d3664ca08..9ac3d4e51d26 100644
--- a/drivers/block/zram/zram_drv.c
+++ b/drivers/block/zram/zram_drv.c
@@ -1362,14 +1362,14 @@ static int zram_read_page(struct zram *zram, struct page *page, u32 index,
ret = zram_read_from_zspool(zram, page, index);
zram_slot_unlock(zram, index);
} else {
+ unsigned long entry = zram_get_element(zram, index);
/*
* The slot should be unlocked before reading from the backing
* device.
*/
zram_slot_unlock(zram, index);

- ret = read_from_bdev(zram, page, zram_get_element(zram, index),
- parent);
+ ret = read_from_bdev(zram, page, entry, parent);
}

/* Should NEVER happen. Return bio error if it does. */
--
2.34.1


2023-11-07 07:39:28

by Sergey Senozhatsky

[permalink] [raw]
Subject: Re: [PATCH] zram: unsafe zram_get_element call in zram_read_page()

On (23/11/06 22:54), Vasily Averin wrote:
> @@ -1362,14 +1362,14 @@ static int zram_read_page(struct zram *zram, struct page *page, u32 index,
> ret = zram_read_from_zspool(zram, page, index);
> zram_slot_unlock(zram, index);
> } else {
> + unsigned long entry = zram_get_element(zram, index);
> /*
> * The slot should be unlocked before reading from the backing
> * device.
> */
> zram_slot_unlock(zram, index);
>
> - ret = read_from_bdev(zram, page, zram_get_element(zram, index),
> - parent);
> + ret = read_from_bdev(zram, page, entry, parent);

Hmmm,
We may want to do more here. Basically, we probably need to re-confirm
after read_from_bdev() that the entry at index still has ZRAM_WB set
and, if so, that it points to the same blk_idx. IOW, check that it has
not been free-ed and re-used under us.

Minchan, what do you think? Is that scenario possible?