Re: + zsmalloc-fix-a-null-pointer-dereference-in-destroy_handle_cache.patch added to -mm tree

Re: + zsmalloc-fix-a-null-pointer-dereference-in-destroy_handle_cache.patch added to -mm tree

[Sergey Senozhatsky]

On (06/08/15 13:55), akpm@linux-foundation.org wrote:
> ------------------------------------------------------
> From: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
> Subject: zsmalloc: fix a null pointer dereference in destroy_handle_cache()
> 
> If zs_create_pool()->create_handle_cache()->kmem_cache_create() fails,
> zs_create_pool()->destroy_handle_cache() will dereference the NULL
> pool->handle_cachep.
> 
> Modify destroy_handle_cache() to avoid this.
> 

Thank you, that's a nicer commit message.

A minor correction, zs_create_pool() can cause NULL pool->handle_cachep
from two places:
-- failed `zs_create_pool()->  pool->name = kstrdup(...)'
-- failed `zs_create_pool()->create_handle_cache()->kmem_cache_create()'



How about the following version:
---
If zs_create_pool()->create_handle_cache()->kmem_cache_create() or
pool->name allocation fails, zs_create_pool()->destroy_handle_cache()
will dereference the NULL pool->handle_cachep.

Modify destroy_handle_cache() to avoid this.

---

	-ss

> Signed-off-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
> Cc: Minchan Kim <minchan@kernel.org>
> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
> ---
> 
>  mm/zsmalloc.c |    3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff -puN mm/zsmalloc.c~zsmalloc-fix-a-null-pointer-dereference-in-destroy_handle_cache mm/zsmalloc.c
> --- a/mm/zsmalloc.c~zsmalloc-fix-a-null-pointer-dereference-in-destroy_handle_cache
> +++ a/mm/zsmalloc.c
> @@ -289,7 +289,8 @@ static int create_handle_cache(struct zs
>  
>  static void destroy_handle_cache(struct zs_pool *pool)
>  {
> -	kmem_cache_destroy(pool->handle_cachep);
> +	if (pool->handle_cachep)
> +		kmem_cache_destroy(pool->handle_cachep);
>  }
>  
>  static unsigned long alloc_handle(struct zs_pool *pool)
> _
> 
> Patches currently in -mm which might be from sergey.senozhatsky@gmail.com are
> 
> zram-clear-disk-io-accounting-when-reset-zram-device.patch
> zsmalloc-fix-a-null-pointer-dereference-in-destroy_handle_cache.patch
> zram-add-compact-sysfs-entry-to-documentation.patch
> zram-cosmetic-zram_attr_ro-code-formatting-tweak.patch
> zram-use-idr-instead-of-zram_devices-array.patch
> zram-reorganize-code-layout.patch
> zram-remove-max_num_devices-limitation.patch
> zram-report-every-added-and-removed-device.patch
> zram-trivial-correct-flag-operations-comment.patch
> zram-return-zram-device_id-from-zram_add.patch
> zram-close-race-by-open-overriding.patch
> zram-add-dynamic-device-add-remove-functionality.patch
> zram-cosmetic-zram_bvec_write-cleanup.patch
> zram-cut-trailing-newline-in-algorithm-name.patch
> zram-check-comp-algorithm-availability-earlier.patch
> zram-check-comp-algorithm-availability-earlier-v2.patch
> linux-next.patch
> 
> --
> To unsubscribe from this list: send the line "unsubscribe mm-commits" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
>