lkml.org 
[lkml]   [2015]   [Jun]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
SubjectRe: + zsmalloc-fix-a-null-pointer-dereference-in-destroy_handle_cache.patch added to -mm tree
On (06/08/15 13:55), akpm@linux-foundation.org wrote:
> ------------------------------------------------------
> From: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
> Subject: zsmalloc: fix a null pointer dereference in destroy_handle_cache()
>
> If zs_create_pool()->create_handle_cache()->kmem_cache_create() fails,
> zs_create_pool()->destroy_handle_cache() will dereference the NULL
> pool->handle_cachep.
>
> Modify destroy_handle_cache() to avoid this.
>

Thank you, that's a nicer commit message.

A minor correction, zs_create_pool() can cause NULL pool->handle_cachep
from two places:
-- failed `zs_create_pool()-> pool->name = kstrdup(...)'
-- failed `zs_create_pool()->create_handle_cache()->kmem_cache_create()'



How about the following version:
---
If zs_create_pool()->create_handle_cache()->kmem_cache_create() or
pool->name allocation fails, zs_create_pool()->destroy_handle_cache()
will dereference the NULL pool->handle_cachep.

Modify destroy_handle_cache() to avoid this.

---

-ss

> Signed-off-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
> Cc: Minchan Kim <minchan@kernel.org>
> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
> ---
>
> mm/zsmalloc.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff -puN mm/zsmalloc.c~zsmalloc-fix-a-null-pointer-dereference-in-destroy_handle_cache mm/zsmalloc.c
> --- a/mm/zsmalloc.c~zsmalloc-fix-a-null-pointer-dereference-in-destroy_handle_cache
> +++ a/mm/zsmalloc.c
> @@ -289,7 +289,8 @@ static int create_handle_cache(struct zs
>
> static void destroy_handle_cache(struct zs_pool *pool)
> {
> - kmem_cache_destroy(pool->handle_cachep);
> + if (pool->handle_cachep)
> + kmem_cache_destroy(pool->handle_cachep);
> }
>
> static unsigned long alloc_handle(struct zs_pool *pool)
> _
>
> Patches currently in -mm which might be from sergey.senozhatsky@gmail.com are
>
> zram-clear-disk-io-accounting-when-reset-zram-device.patch
> zsmalloc-fix-a-null-pointer-dereference-in-destroy_handle_cache.patch
> zram-add-compact-sysfs-entry-to-documentation.patch
> zram-cosmetic-zram_attr_ro-code-formatting-tweak.patch
> zram-use-idr-instead-of-zram_devices-array.patch
> zram-reorganize-code-layout.patch
> zram-remove-max_num_devices-limitation.patch
> zram-report-every-added-and-removed-device.patch
> zram-trivial-correct-flag-operations-comment.patch
> zram-return-zram-device_id-from-zram_add.patch
> zram-close-race-by-open-overriding.patch
> zram-add-dynamic-device-add-remove-functionality.patch
> zram-cosmetic-zram_bvec_write-cleanup.patch
> zram-cut-trailing-newline-in-algorithm-name.patch
> zram-check-comp-algorithm-availability-earlier.patch
> zram-check-comp-algorithm-availability-earlier-v2.patch
> linux-next.patch
>
> --
> To unsubscribe from this list: send the line "unsubscribe mm-commits" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
>


\
 
 \ /
  Last update: 2015-06-09 04:21    [W:0.036 / U:1.212 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site