diff options
| author | Uladzislau Rezki <[email protected]> | 2020-05-22 22:23:12 -0700 |
|---|---|---|
| committer | Linus Torvalds <[email protected]> | 2020-05-23 10:26:32 -0700 |
| commit | d8f117abb380ba968b5e3ef2042d901c02872a4c (patch) | |
| tree | 8d38eb4409e79bf06db06520e0063dd57038d002 /include/linux/fpga/fpga-mgr.h | |
| parent | c2bc26f7ca1ff1165bb6669a7a4cccc20ffd2ced (diff) | |
z3fold: fix use-after-free when freeing handles
free_handle() for a foreign handle may race with inter-page compaction,
what can lead to memory corruption.
To avoid that, take write lock not read lock in free_handle to be
synchronized with __release_z3fold_page().
For example KASAN can detect it:
==================================================================
BUG: KASAN: use-after-free in LZ4_decompress_safe+0x2c4/0x3b8
Read of size 1 at addr ffffffc976695ca3 by task GoogleApiHandle/4121
CPU: 0 PID: 4121 Comm: GoogleApiHandle Tainted: P S OE 4.19.81-perf+ #162
Hardware name: Sony Mobile Communications. PDX-203(KONA) (DT)
Call trace:
LZ4_decompress_safe+0x2c4/0x3b8
lz4_decompress_crypto+0x3c/0x70
crypto_decompress+0x58/0x70
zcomp_decompress+0xd4/0x120
...
Apart from that, initialize zhdr->mapped_count in init_z3fold_page() and
remove "newpage" variable because it is not used anywhere.
Signed-off-by: Uladzislau Rezki <[email protected]>
Signed-off-by: Vitaly Wool <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Cc: Qian Cai <[email protected]>
Cc: Raymond Jennings <[email protected]>
Cc: <[email protected]>
Link: http://lkml.kernel.org/r/[email protected]
Signed-off-by: Linus Torvalds <[email protected]>
Diffstat (limited to 'include/linux/fpga/fpga-mgr.h')
0 files changed, 0 insertions, 0 deletions