Patch "drivers/block/zram/zram_drv.c: do not keep dangling zcomp pointer after zram reset" has been added to the 5.10-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    drivers/block/zram/zram_drv.c: do not keep dangling zcomp pointer after zram reset

to the 5.10-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     drivers-block-zram-zram_drv.c-do-not-keep-dangling-z.patch
and it can be found in the queue-5.10 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 6c5f7461bae51ae92a916c899f0378ba84775dd0
Author: Sergey Senozhatsky <senozhatsky@xxxxxxxxxxxx>
Date:   Wed Aug 24 12:51:00 2022 +0900

    drivers/block/zram/zram_drv.c: do not keep dangling zcomp pointer after zram reset
    
    [ Upstream commit 6d2453c3dbc5f70eafc1c866289a90a1fc57ce18 ]
    
    We do all reset operations under write lock, so we don't need to save
    ->disksize and ->comp to stack variables.  Another thing is that ->comp is
    freed during zram reset, but comp pointer is not NULL-ed, so zram keeps
    the freed pointer value.
    
    Link: https://lkml.kernel.org/r/20220824035100.971816-1-senozhatsky@xxxxxxxxxxxx
    Signed-off-by: Sergey Senozhatsky <senozhatsky@xxxxxxxxxxxx>
    Cc: Minchan Kim <minchan@xxxxxxxxxx>
    Cc: Nitin Gupta <ngupta@xxxxxxxxxx>
    Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
    Stable-dep-of: 74363ec674cb ("zram: fix uninitialized ZRAM not releasing backing device")
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
index 8f38e5a1a63f..8e13586be8c9 100644
--- a/drivers/block/zram/zram_drv.c
+++ b/drivers/block/zram/zram_drv.c
@@ -1690,9 +1690,6 @@ static int zram_rw_page(struct block_device *bdev, sector_t sector,
 
 static void zram_reset_device(struct zram *zram)
 {
-	struct zcomp *comp;
-	u64 disksize;
-
 	down_write(&zram->init_lock);
 
 	zram->limit_pages = 0;
@@ -1702,18 +1699,16 @@ static void zram_reset_device(struct zram *zram)
 		return;
 	}
 
-	comp = zram->comp;
-	disksize = zram->disksize;
-	zram->disksize = 0;
-
 	set_capacity_and_notify(zram->disk, 0);
 	part_stat_set_all(&zram->disk->part0, 0);
 
 	up_write(&zram->init_lock);
 	/* I/O operation under all of CPU are done so let's free */
-	zram_meta_free(zram, disksize);
+	zram_meta_free(zram, zram->disksize);
+	zram->disksize = 0;
 	memset(&zram->stats, 0, sizeof(zram->stats));
-	zcomp_destroy(comp);
+	zcomp_destroy(zram->comp);
+	zram->comp = NULL;
 	reset_bdev(zram);
 }