zram_free_page() is protected by down_write(&zram->lock) when called by zram_bvec_write(), but there's no such protection when called by zram_slot_free_notify(), which may cause wrong states to zram object. There are two possible consequences of this issue: 1) It may cause invalid memory access if we read from a zram device used as swap device. (Not sure whether it's legal to make read/write requests to a zram device used as swap device.) 2) It may cause some fields (bad_compress, good_compress, pages_stored) in zram->stats wrong if the swap layer makes concurrently call to zram_slot_free_notify(). So enhance zram_slot_free_notify() to acquire writer lock on zram->lock before calling zram_free_page(). Signed-off-by: Jiang Liu <jiang.liu@xxxxxxxxxx> Cc: stable@xxxxxxxxxxxxxxx --- drivers/staging/zram/zram_drv.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/staging/zram/zram_drv.c b/drivers/staging/zram/zram_drv.c index 5a2f20b..847d207 100644 --- a/drivers/staging/zram/zram_drv.c +++ b/drivers/staging/zram/zram_drv.c @@ -582,7 +582,9 @@ static void zram_slot_free_notify(struct block_device *bdev, struct zram *zram; zram = bdev->bd_disk->private_data; + down_write(&zram->lock); zram_free_page(zram, index); + up_write(&zram->lock); zram_stat64_inc(zram, &zram->stats.notify_free); } -- 1.8.1.2 _______________________________________________ devel mailing list devel@xxxxxxxxxxxxxxxxxxxxxx http://driverdev.linuxdriverproject.org/mailman/listinfo/devel
