tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

zram: fix slot write race condition

Parallel concurrent writes to the same zram index result in leaked
zsmalloc handles. Schematically we can have something like this:

CPU0 CPU1
zram_slot_lock()
zs_free(handle)
zram_slot_lock()
zram_slot_lock()
zs_free(handle)
zram_slot_lock()

compress compress
handle = zs_malloc() handle = zs_malloc()
zram_slot_lock
zram_set_handle(handle)
zram_slot_lock
zram_slot_lock
zram_set_handle(handle)
zram_slot_lock

Either CPU0 or CPU1 zsmalloc handle will leak because zs_free() is done
too early. In fact, we need to reset zram entry right before we set its
new handle, all under the same slot lock scope.

Link: https://lkml.kernel.org/r/20250909045150.635345-1-senozhatsky@chromium.org
Fixes: 71268035f5d7 ("zram: free slot memory early during write")
Signed-off-by: Sergey Senozhatsky <senozhatsky@chromium.org>
Reported-by: Changhui Zhong <czhong@redhat.com>
Closes: https://lore.kernel.org/all/CAGVVp+UtpGoW5WEdEU7uVTtsSCjPN=ksN6EcvyypAtFDOUf30A@mail.gmail.com/
Tested-by: Changhui Zhong <czhong@redhat.com>
Cc: Jens Axboe <axboe@kernel.dk>
Cc: Minchan Kim <minchan@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>

authored by

Sergey Senozhatsky and committed by
Andrew Morton ce4be9e4 025e87f8

+3 -5
+3 -5
drivers/block/zram/zram_drv.c
··· 1795 1795 u32 index) 1796 1796 { 1797 1797 zram_slot_lock(zram, index); 1798 + zram_free_page(zram, index); 1798 1799 zram_set_flag(zram, index, ZRAM_SAME); 1799 1800 zram_set_handle(zram, index, fill); 1800 1801 zram_slot_unlock(zram, index); ··· 1833 1832 kunmap_local(src); 1834 1833 1835 1834 zram_slot_lock(zram, index); 1835 + zram_free_page(zram, index); 1836 1836 zram_set_flag(zram, index, ZRAM_HUGE); 1837 1837 zram_set_handle(zram, index, handle); 1838 1838 zram_set_obj_size(zram, index, PAGE_SIZE); ··· 1856 1854 struct zcomp_strm *zstrm; 1857 1855 unsigned long element; 1858 1856 bool same_filled; 1859 - 1860 - /* First, free memory allocated to this slot (if any) */ 1861 - zram_slot_lock(zram, index); 1862 - zram_free_page(zram, index); 1863 - zram_slot_unlock(zram, index); 1864 1857 1865 1858 mem = kmap_local_page(page); 1866 1859 same_filled = page_same_filled(mem, &element); ··· 1898 1901 zcomp_stream_put(zstrm); 1899 1902 1900 1903 zram_slot_lock(zram, index); 1904 + zram_free_page(zram, index); 1901 1905 zram_set_handle(zram, index, handle); 1902 1906 zram_set_obj_size(zram, index, comp_len); 1903 1907 zram_slot_unlock(zram, index);