From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752435AbaFLXTT (ORCPT ); Thu, 12 Jun 2014 19:19:19 -0400 Received: from mail.linuxfoundation.org ([140.211.169.12]:37303 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751058AbaFLXTO (ORCPT ); Thu, 12 Jun 2014 19:19:14 -0400 From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jiang Liu , Minchan Kim , Ben Hutchings , Yijing Wang Subject: [PATCH 3.4 4/8] zram: protect sysfs handler from invalid memory access Date: Thu, 12 Jun 2014 16:22:51 -0700 Message-Id: <20140612232238.789898097@linuxfoundation.org> X-Mailer: git-send-email 2.0.0.254.g50f84e3 In-Reply-To: <20140612232238.396722659@linuxfoundation.org> References: <20140612232238.396722659@linuxfoundation.org> User-Agent: quilt/0.63-1 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 3.4-stable review patch. If anyone has any objections, please let me know. ------------------ From: Jiang Liu commit 5863e10b441e7ea4b492f930f1be180a97d026f3 upstream. Use zram->init_lock to protect access to zram->meta, otherwise it may cause invalid memory access if zram->meta has been freed by zram_reset_device(). This issue may be triggered by: Thread 1: while true; do cat mem_used_total; done Thread 2: while true; do echo 8M > disksize; echo 1 > reset; done Signed-off-by: Jiang Liu Acked-by: Minchan Kim [bwh: Backported to 3.2: adjust context] Signed-off-by: Ben Hutchings [wyj: Backported to 3.4: adjust context] Signed-off-by: Yijing Wang Signed-off-by: Greg Kroah-Hartman --- drivers/staging/zram/zram_sysfs.c | 2 ++ 1 file changed, 2 insertions(+) --- a/drivers/staging/zram/zram_sysfs.c +++ b/drivers/staging/zram/zram_sysfs.c @@ -188,10 +188,12 @@ static ssize_t mem_used_total_show(struc u64 val = 0; struct zram *zram = dev_to_zram(dev); + down_read(&zram->init_lock); if (zram->init_done) { val = zs_get_total_size_bytes(zram->mem_pool) + ((u64)(zram->stats.pages_expand) << PAGE_SHIFT); } + up_read(&zram->init_lock); return sprintf(buf, "%llu\n", val); }