The patch titled Subject: zram: pass down the bvec we need to read into in the work struct has been added to the -mm tree. Its filename is zram-pass-down-the-bvec-we-need-to-read-into-in-the-work-struct.patch This patch should soon appear at http://ozlabs.org/~akpm/mmots/broken-out/zram-pass-down-the-bvec-we-need-to-read-into-in-the-work-struct.patch and later at http://ozlabs.org/~akpm/mmotm/broken-out/zram-pass-down-the-bvec-we-need-to-read-into-in-the-work-struct.patch Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/process/submit-checklist.rst when testing your code *** The -mm tree is included into linux-next and is updated there every 3-4 working days ------------------------------------------------------ From: Jérôme Glisse <jglisse@xxxxxxxxxx> Subject: zram: pass down the bvec we need to read into in the work struct When scheduling work item to read page we need to pass down the proper bvec struct which points to the page to read into. Before this patch it uses a randomly initialized bvec (only if PAGE_SIZE != 4096) which is wrong. Note that without this patch on arch/kernel where PAGE_SIZE != 4096 userspace could read random memory through a zram block device (thought userspace probably would have no control on the address being read). Link: http://lkml.kernel.org/r/20190408183219.26377-1-jglisse@xxxxxxxxxx Signed-off-by: Jérôme Glisse <jglisse@xxxxxxxxxx> Reviewed-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> Cc: Minchan Kim <minchan@xxxxxxxxxx> Cc: Nitin Gupta <ngupta@xxxxxxxxxx> Cc: Sergey Senozhatsky <sergey.senozhatsky.work@xxxxxxxxx> Cc: <stable@xxxxxxxxxxxxxxx> Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> --- drivers/block/zram/zram_drv.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) --- a/drivers/block/zram/zram_drv.c~zram-pass-down-the-bvec-we-need-to-read-into-in-the-work-struct +++ a/drivers/block/zram/zram_drv.c @@ -774,18 +774,18 @@ struct zram_work { struct zram *zram; unsigned long entry; struct bio *bio; + struct bio_vec bvec; }; #if PAGE_SIZE != 4096 static void zram_sync_read(struct work_struct *work) { - struct bio_vec bvec; struct zram_work *zw = container_of(work, struct zram_work, work); struct zram *zram = zw->zram; unsigned long entry = zw->entry; struct bio *bio = zw->bio; - read_from_bdev_async(zram, &bvec, entry, bio); + read_from_bdev_async(zram, &zw->bvec, entry, bio); } /* @@ -798,6 +798,7 @@ static int read_from_bdev_sync(struct zr { struct zram_work work; + work.bvec = *bvec; work.zram = zram; work.entry = entry; work.bio = bio; _ Patches currently in -mm which might be from jglisse@xxxxxxxxxx are zram-pass-down-the-bvec-we-need-to-read-into-in-the-work-struct.patch mm-hmm-select-mmu-notifier-when-selecting-hmm-v2.patch mm-hmm-use-reference-counting-for-hmm-struct-v3.patch mm-hmm-do-not-erase-snapshot-when-a-range-is-invalidated.patch mm-hmm-improve-and-rename-hmm_vma_get_pfns-to-hmm_range_snapshot-v2.patch mm-hmm-improve-and-rename-hmm_vma_fault-to-hmm_range_fault-v3.patch mm-hmm-improve-driver-api-to-work-and-wait-over-a-range-v3.patch mm-hmm-add-default-fault-flags-to-avoid-the-need-to-pre-fill-pfns-arrays-v2.patch mm-hmm-mirror-hugetlbfs-snapshoting-faulting-and-dma-mapping-v3.patch mm-hmm-allow-to-mirror-vma-of-a-file-on-a-dax-backed-filesystem-v3.patch mm-hmm-add-helpers-to-test-if-mm-is-still-alive-or-not.patch mm-hmm-add-an-helper-function-that-fault-pages-and-map-them-to-a-device-v3.patch mm-hmm-add-an-helper-function-that-fault-pages-and-map-them-to-a-device-v3-fix.patch mm-hmm-convert-various-hmm_pfn_-to-device_entry-which-is-a-better-name.patch mm-mmu_notifier-helper-to-test-if-a-range-invalidation-is-blockable.patch mm-mmu_notifier-convert-user-range-blockable-to-helper-function.patch mm-mmu_notifier-convert-mmu_notifier_range-blockable-to-a-flags.patch mm-mmu_notifier-contextual-information-for-event-enums.patch mm-mmu_notifier-contextual-information-for-event-triggering-invalidation-v2.patch mm-mmu_notifier-use-correct-mmu_notifier-events-for-each-invalidation.patch mm-mmu_notifier-pass-down-vma-and-reasons-why-mmu-notifier-is-happening-v2.patch mm-mmu_notifier-mmu_notifier_range_update_to_read_only-helper.patch