* [PATCH 6.6.y 2/4] zram: fix the issue that the write - back limits might overflow
2026-09-05 1:12 ` [PATCH 6.6.y 1/4] zram: take write lock in wb limit store handlers Sasha Levin
@ 2026-09-05 1:12 ` Sasha Levin
2026-09-05 1:12 ` [PATCH 6.6.y 3/4] zram: move bd_stat to writeback section Sasha Levin
2026-09-05 1:12 ` [PATCH 6.6.y 4/4] zram: set default primary compressor in zram_destroy_comps() Sasha Levin
2 siblings, 0 replies; 5+ messages in thread
From: Sasha Levin @ 2026-09-05 1:12 UTC (permalink / raw)
To: stable
Cc: Yuwen Chen, Sergey Senozhatsky, Brian Geffon, Minchan Kim,
Richard Chang, Andrew Morton, Sasha Levin
From: Yuwen Chen <ywen.chen@foxmail.com>
[ Upstream commit 04d31610a7221cca624646241b1f6b3edd6c99fd ]
When the page size exceeds 4KB, if bd_wb_limit is set to a value that is
not aligned with the page size, it will cause a numerical wrap-around
issue for bd_wb_limit. For example, when the page size is set to 16KB and
bd_wb_limit is set to 3, after one write-back operation, the value of
bd_wb_limit will become -1. More seriously, since bd_wb_limit is an
unsigned number, its value may become as large as 2^64 - 1.
The core reason for this problem is that the unit of bd_wb_limit is 4KB.
For example, when a write-back occurs on a system with a page size of
16KB, 4 needs to be subtracted from bd_wb_limit. This operation takes
place in the zram_account_writeback_submit function.
This patch fixes the issue by limiting bd_wb_limit to be an integer
multiple of PAGE_SIZE / 4096.
Link: https://lkml.kernel.org/r/tencent_5936CFE72BAB2BA76887BB69DCC1B5E67C05@qq.com
Fixes: 1d69a3f8ae77 ("zram: idle writeback fixes and cleanup")
Signed-off-by: Yuwen Chen <ywen.chen@foxmail.com>
Acked-by: Sergey Senozhatsky <senozhatsky@chromium.org>
Cc: Brian Geffon <bgeffon@google.com>
Cc: Minchan Kim <minchan@kernel.org>
Cc: Richard Chang <richardycc@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Stable-dep-of: dde75313eed0 ("zram: set default primary compressor in zram_destroy_comps()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/block/zram/zram_drv.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
index 8e99f453371e3..64a1136447cf5 100644
--- a/drivers/block/zram/zram_drv.c
+++ b/drivers/block/zram/zram_drv.c
@@ -412,6 +412,16 @@ static ssize_t writeback_limit_store(struct device *dev,
if (kstrtoull(buf, 10, &val))
return ret;
+ /*
+ * When the page size is greater than 4KB, if bd_wb_limit is set to
+ * a value that is not page - size aligned, it will cause value
+ * wrapping. For example, when the page size is set to 16KB and
+ * bd_wb_limit is set to 3, a single write - back operation will
+ * cause bd_wb_limit to become -1. Even more terrifying is that
+ * bd_wb_limit is an unsigned number.
+ */
+ val = rounddown(val, PAGE_SIZE / 4096);
+
down_write(&zram->init_lock);
spin_lock(&zram->wb_limit_lock);
zram->bd_wb_limit = val;
--
2.53.0
^ permalink raw reply related [flat|nested] 5+ messages in thread* [PATCH 6.6.y 3/4] zram: move bd_stat to writeback section
2026-09-05 1:12 ` [PATCH 6.6.y 1/4] zram: take write lock in wb limit store handlers Sasha Levin
2026-09-05 1:12 ` [PATCH 6.6.y 2/4] zram: fix the issue that the write - back limits might overflow Sasha Levin
@ 2026-09-05 1:12 ` Sasha Levin
2026-09-05 1:12 ` [PATCH 6.6.y 4/4] zram: set default primary compressor in zram_destroy_comps() Sasha Levin
2 siblings, 0 replies; 5+ messages in thread
From: Sasha Levin @ 2026-09-05 1:12 UTC (permalink / raw)
To: stable
Cc: Sergey Senozhatsky, Brian Geffon, David Stevens, Minchan Kim,
Richard Chang, Andrew Morton, Sasha Levin
From: Sergey Senozhatsky <senozhatsky@chromium.org>
[ Upstream commit 910bbb441c004050e188dd8da5071054099e592c ]
Move bd_stat function and attribute declaration to
existing CONFIG_WRITEBACK ifdef-sections.
Link: https://lkml.kernel.org/r/20251201094754.4149975-5-senozhatsky@chromium.org
Signed-off-by: Sergey Senozhatsky <senozhatsky@chromium.org>
Cc: Brian Geffon <bgeffon@google.com>
Cc: David Stevens <stevensd@google.com>
Cc: Minchan Kim <minchan@google.com>
Cc: Richard Chang <richardycc@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Stable-dep-of: dde75313eed0 ("zram: set default primary compressor in zram_destroy_comps()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/block/zram/zram_drv.c | 54 ++++++++++++++++-------------------
1 file changed, 25 insertions(+), 29 deletions(-)
diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
index 64a1136447cf5..6a4870cf6e590 100644
--- a/drivers/block/zram/zram_drv.c
+++ b/drivers/block/zram/zram_drv.c
@@ -364,6 +364,24 @@ static ssize_t idle_store(struct device *dev,
}
#ifdef CONFIG_ZRAM_WRITEBACK
+#define FOUR_K(x) ((x) * (1 << (PAGE_SHIFT - 12)))
+static ssize_t bd_stat_show(struct device *dev,
+ struct device_attribute *attr, char *buf)
+{
+ struct zram *zram = dev_to_zram(dev);
+ ssize_t ret;
+
+ down_read(&zram->init_lock);
+ ret = scnprintf(buf, PAGE_SIZE,
+ "%8llu %8llu %8llu\n",
+ FOUR_K((u64)atomic64_read(&zram->stats.bd_count)),
+ FOUR_K((u64)atomic64_read(&zram->stats.bd_reads)),
+ FOUR_K((u64)atomic64_read(&zram->stats.bd_writes)));
+ up_read(&zram->init_lock);
+
+ return ret;
+}
+
static ssize_t writeback_limit_enable_store(struct device *dev,
struct device_attribute *attr,
const char *buf, size_t len)
@@ -1200,27 +1218,6 @@ static ssize_t mm_stat_show(struct device *dev,
return ret;
}
-
-#ifdef CONFIG_ZRAM_WRITEBACK
-#define FOUR_K(x) ((x) * (1 << (PAGE_SHIFT - 12)))
-static ssize_t bd_stat_show(struct device *dev,
- struct device_attribute *attr, char *buf)
-{
- struct zram *zram = dev_to_zram(dev);
- ssize_t ret;
-
- down_read(&zram->init_lock);
- ret = scnprintf(buf, PAGE_SIZE,
- "%8llu %8llu %8llu\n",
- FOUR_K((u64)atomic64_read(&zram->stats.bd_count)),
- FOUR_K((u64)atomic64_read(&zram->stats.bd_reads)),
- FOUR_K((u64)atomic64_read(&zram->stats.bd_writes)));
- up_read(&zram->init_lock);
-
- return ret;
-}
-#endif
-
static ssize_t debug_stat_show(struct device *dev,
struct device_attribute *attr, char *buf)
{
@@ -1241,9 +1238,6 @@ static ssize_t debug_stat_show(struct device *dev,
static DEVICE_ATTR_RO(io_stat);
static DEVICE_ATTR_RO(mm_stat);
-#ifdef CONFIG_ZRAM_WRITEBACK
-static DEVICE_ATTR_RO(bd_stat);
-#endif
static DEVICE_ATTR_RO(debug_stat);
static void zram_meta_free(struct zram *zram, u64 disksize)
@@ -2014,6 +2008,7 @@ static void zram_slot_free_notify(struct block_device *bdev,
zram_slot_unlock(zram, index);
}
+#define zram_comp_params_reset(_zram) ((void)(_zram))
static void zram_destroy_comps(struct zram *zram)
{
u32 prio;
@@ -2034,11 +2029,14 @@ static void zram_destroy_comps(struct zram *zram)
kfree(zram->comp_algs[prio]);
zram->comp_algs[prio] = NULL;
}
+
+ zram_comp_params_reset(zram);
}
+#undef zram_comp_params_reset
static void zram_reset_device(struct zram *zram)
{
- down_write(&zram->init_lock);
+ guard(rwsem_write)(&zram->init_lock);
zram->limit_pages = 0;
@@ -2053,7 +2051,6 @@ static void zram_reset_device(struct zram *zram)
reset_bdev(zram);
comp_algorithm_set(zram, ZRAM_PRIMARY_COMP, default_compressor);
- up_write(&zram->init_lock);
}
static ssize_t disksize_store(struct device *dev,
@@ -2180,6 +2177,7 @@ static DEVICE_ATTR_WO(idle);
static DEVICE_ATTR_RW(max_comp_streams);
static DEVICE_ATTR_RW(comp_algorithm);
#ifdef CONFIG_ZRAM_WRITEBACK
+static DEVICE_ATTR_RO(bd_stat);
static DEVICE_ATTR_RW(backing_dev);
static DEVICE_ATTR_WO(writeback);
static DEVICE_ATTR_RW(writeback_limit);
@@ -2201,6 +2199,7 @@ static struct attribute *zram_disk_attrs[] = {
&dev_attr_max_comp_streams.attr,
&dev_attr_comp_algorithm.attr,
#ifdef CONFIG_ZRAM_WRITEBACK
+ &dev_attr_bd_stat.attr,
&dev_attr_backing_dev.attr,
&dev_attr_writeback.attr,
&dev_attr_writeback_limit.attr,
@@ -2208,9 +2207,6 @@ static struct attribute *zram_disk_attrs[] = {
#endif
&dev_attr_io_stat.attr,
&dev_attr_mm_stat.attr,
-#ifdef CONFIG_ZRAM_WRITEBACK
- &dev_attr_bd_stat.attr,
-#endif
&dev_attr_debug_stat.attr,
#ifdef CONFIG_ZRAM_MULTI_COMP
&dev_attr_recomp_algorithm.attr,
--
2.53.0
^ permalink raw reply related [flat|nested] 5+ messages in thread* [PATCH 6.6.y 4/4] zram: set default primary compressor in zram_destroy_comps()
2026-09-05 1:12 ` [PATCH 6.6.y 1/4] zram: take write lock in wb limit store handlers Sasha Levin
2026-09-05 1:12 ` [PATCH 6.6.y 2/4] zram: fix the issue that the write - back limits might overflow Sasha Levin
2026-09-05 1:12 ` [PATCH 6.6.y 3/4] zram: move bd_stat to writeback section Sasha Levin
@ 2026-09-05 1:12 ` Sasha Levin
2 siblings, 0 replies; 5+ messages in thread
From: Sasha Levin @ 2026-09-05 1:12 UTC (permalink / raw)
To: stable
Cc: Sergey Senozhatsky, Minchan Kim, Haoqin Huang, Andrew Morton,
Sasha Levin
From: Sergey Senozhatsky <senozhatsky@chromium.org>
[ Upstream commit dde75313eed0b014c437f48dd75c0308b592cbf9 ]
Patch series "zram: fix zram issues reported by sashiko".
Sashiko drove by and reported [1] a couple of zram issues:
a possible BUG_ON() in zlib code due to missing winbits range
validation and one possible NULL-ptr dereference in zcomp.
Both are low risk yet still worth fixing.
This patch (of 2):
zram_destroy_comps() resets all compressors and leaves them set to NULL,
including the primary one, which is invalid device state, as now
comp_algorithm_show()->strcmp() can be called on a NULL compressor. Set
default primary compressor in zram_destroy_comps().
Link: https://lore.kernel.org/20260729045745.775973-2-senozhatsky@chromium.org
Fixes: 486fd58af7ac ("zram: don't free statically defined names")
Link: https://sashiko.dev/#/patchset/20260728092935.31139-1-haoqinhuang7@gmail.com [1]
Signed-off-by: Sergey Senozhatsky <senozhatsky@chromium.org>
Cc: Minchan Kim <minchan@kernel.org>
Cc: Haoqin Huang <haoqinhuang7@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/block/zram/zram_drv.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
index 6a4870cf6e590..d7d4e39530392 100644
--- a/drivers/block/zram/zram_drv.c
+++ b/drivers/block/zram/zram_drv.c
@@ -2031,6 +2031,7 @@ static void zram_destroy_comps(struct zram *zram)
}
zram_comp_params_reset(zram);
+ comp_algorithm_set(zram, ZRAM_PRIMARY_COMP, default_compressor);
}
#undef zram_comp_params_reset
@@ -2049,8 +2050,6 @@ static void zram_reset_device(struct zram *zram)
zram_destroy_comps(zram);
memset(&zram->stats, 0, sizeof(zram->stats));
reset_bdev(zram);
-
- comp_algorithm_set(zram, ZRAM_PRIMARY_COMP, default_compressor);
}
static ssize_t disksize_store(struct device *dev,
--
2.53.0
^ permalink raw reply related [flat|nested] 5+ messages in thread