diff options
| author | Vitaly Wool | 2019-07-17 01:25:48 +0200 |
|---|---|---|
| committer | Linus Torvalds | 2019-07-17 04:23:21 +0200 |
| commit | bb9a374dfa3a2f46581455ab66cd1d24c5e3d183 (patch) | |
| tree | 654cb71efb841e60b08a23e1f85899eefb1f9e9c /mm/shmem.c | |
| parent | Merge tag 'backlight-next-5.3' of git://git.kernel.org/pub/scm/linux/kernel/g... (diff) | |
| download | kernel-qcow2-linux-bb9a374dfa3a2f46581455ab66cd1d24c5e3d183.tar.gz kernel-qcow2-linux-bb9a374dfa3a2f46581455ab66cd1d24c5e3d183.tar.xz kernel-qcow2-linux-bb9a374dfa3a2f46581455ab66cd1d24c5e3d183.zip | |
mm/z3fold: don't try to use buddy slots after free
As reported by Henry Burns:
Running z3fold stress testing with address sanitization showed zhdr->slots
was being used after it was freed.
z3fold_free(z3fold_pool, handle)
free_handle(handle)
kmem_cache_free(pool->c_handle, zhdr->slots)
release_z3fold_page_locked_list(kref)
__release_z3fold_page(zhdr, true)
zhdr_to_pool(zhdr)
slots_to_pool(zhdr->slots) *BOOM*
To fix this, add pointer to the pool back to z3fold_header and modify
zhdr_to_pool to return zhdr->pool.
Link: http://lkml.kernel.org/r/20190708134808.e89f3bfadd9f6ffd7eff9ba9@gmail.com
Fixes: 7c2b8baa61fe ("mm/z3fold.c: add structure for buddy handles")
Signed-off-by: Vitaly Wool <vitalywool@gmail.com>
Reported-by: Henry Burns <henryburns@google.com>
Reviewed-by: Shakeel Butt <shakeelb@google.com>
Cc: Jonathan Adams <jwadams@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'mm/shmem.c')
0 files changed, 0 insertions, 0 deletions