On 06/04/2013 06:06 PM, Jiang Liu wrote: > zram_free_page() is protected by down_write(&zram->lock) when called by > zram_bvec_write(), but there's no such protection when called by > zram_slot_free_notify(), which may cause wrong states to zram object. > > There are two possible consequences of this issue: > 1) It may cause invalid memory access if we read from a zram device used > as swap device. (Not sure whether it's legal to make read/write > requests to a zram device used as swap device.) It's never a good idea to mess with a swap device in use, but AFAICT nothing prevents it (save for file permissions and admin sanity). Jerome > 2) It may cause some fields (bad_compress, good_compress, pages_stored) > in zram->stats wrong if the swap layer makes concurrently call to > zram_slot_free_notify(). > > So enhance zram_slot_free_notify() to acquire writer lock on zram->lock > before calling zram_free_page(). > > Signed-off-by: Jiang Liu <jiang.liu@xxxxxxxxxx> > Cc: stable@xxxxxxxxxxxxxxx > --- > drivers/staging/zram/zram_drv.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/drivers/staging/zram/zram_drv.c b/drivers/staging/zram/zram_drv.c > index 5a2f20b..847d207 100644 > --- a/drivers/staging/zram/zram_drv.c > +++ b/drivers/staging/zram/zram_drv.c > @@ -582,7 +582,9 @@ static void zram_slot_free_notify(struct block_device *bdev, > struct zram *zram; > > zram = bdev->bd_disk->private_data; > + down_write(&zram->lock); > zram_free_page(zram, index); > + up_write(&zram->lock); > zram_stat64_inc(zram, &zram->stats.notify_free); > } > > _______________________________________________ devel mailing list devel@xxxxxxxxxxxxxxxxxxxxxx http://driverdev.linuxdriverproject.org/mailman/listinfo/devel
