Messages in this thread | | | Date | Mon, 29 Oct 2012 20:33:45 +0300 | From | Sergey Senozhatsky <> | Subject | Re: [PATCH 1/2] zram: factor-out zram_decompress_page() function |
| |
On (10/29/12 10:14), Nitin Gupta wrote: > > "Read before write" message is not valid in case ZRAM_ZERO flag is > set. Its true only in !handle case. >
do we actually need this message?
> Otherwise, the patch looks good to me. > > On a side note, zram still contains a known use-after-free bug > reported by Fengguang Wu (CC'ed) which happens in the "partial I/O" > i.e. non PAGE_SIZE'ed I/O case which is fixed by the following patch. > > Please let me know if you can include the following patch when you > resend this patch series, or I can do the same or will wait for this > to be merged and then send it later. >
Nitin, I think let's deal with one change at a time. I'll try to resend my patch shortly, then we can continue with your fix (I didn't hit that problem, though will be happy to help with testing).
-ss
> ====== > zram: Fix use-after-free in partial I/O case > > When the compressed size of a page exceeds a threshold, the page is > stored as-is i.e. in uncompressed form. In the partial I/O i.e. > non-PAGE_SIZE'ed I/O case, however, the uncompressed memory was being > freed before it could be copied into the zsmalloc pool resulting in > use-after-free bug. > > Signed-off-by: Nitin Gupta <ngupta@vflare.org> > --- > > diff --git a/drivers/staging/zram/zram_drv.c > b/drivers/staging/zram/zram_drv.c > index 7585467..635736b 100644 > --- a/drivers/staging/zram/zram_drv.c > +++ b/drivers/staging/zram/zram_drv.c > @@ -288,10 +288,8 @@ static int zram_bvec_write(struct zram *zram, > struct bio_vec *bvec, u32 index, > goto out; > } > ret = zram_decompress_page(zram, uncmem, index); > - if (ret) { > - kfree(uncmem); > + if (ret) > goto out; > - } > } > > /* > @@ -312,8 +310,6 @@ static int zram_bvec_write(struct zram *zram, > struct bio_vec *bvec, u32 index, > > if (page_zero_filled(uncmem)) { > kunmap_atomic(user_mem); > - if (is_partial_io(bvec)) > - kfree(uncmem); > zram_stat_inc(&zram->stats.pages_zero); > zram_set_flag(zram, index, ZRAM_ZERO); > ret = 0; > @@ -324,8 +320,6 @@ static int zram_bvec_write(struct zram *zram, > struct bio_vec *bvec, u32 index, > zram->compress_workmem); > > kunmap_atomic(user_mem); > - if (is_partial_io(bvec)) > - kfree(uncmem); > > if (unlikely(ret != LZO_E_OK)) { > pr_err("Compression failed! err=%d\n", ret); > @@ -360,11 +354,15 @@ static int zram_bvec_write(struct zram *zram, > struct bio_vec *bvec, u32 index, > if (clen <= PAGE_SIZE / 2) > zram_stat_inc(&zram->stats.good_compress); > > - return 0; > + ret = 0; > > out: > if (ret) > zram_stat64_inc(zram, &zram->stats.failed_writes); > + > + if (is_partial_io(bvec)) > + kfree(uncmem); > + > return ret; > } > > > BTW, I could not trigger this partial I/O case, so please let me know > if you hit any issue during your testing. > > There is another sparse warning to be fixed: zram_reset_device should > be static. > > Thanks, > Nitin >
| |