Messages in this thread | | | Date | Tue, 19 Sep 2017 14:39:35 +0900 | From | Sergey Senozhatsky <> | Subject | Re: [PATCH] zram: fix null dereference of handle |
| |
On (09/19/17 11:34), Minchan Kim wrote: [..] > static void zram_meta_free(struct zram *zram, u64 disksize) > { > size_t num_pages = disksize >> PAGE_SHIFT; > @@ -876,11 +855,18 @@ static int __zram_bvec_read(struct zram *zram, struct page *page, u32 index, > zram_slot_unlock(zram, index); > } > > - if (zram_same_page_read(zram, index, page, 0, PAGE_SIZE)) > - return 0; > - > zram_slot_lock(zram, index); > handle = zram_get_handle(zram, index); > + if (unlikely(!handle || zram_test_flag(zram, index, ZRAM_SAME))) { > + void *mem;
is this branch really unlikely()? ZRAM_SAME ratio really depends, on some setups it can be quite likely, I suspect.
another question, "!handle == value & ZRAM_SAME"? if so, then why not just check for `flags & ZRAM_SAME'? if not then:
- for `value & ZRAM_SAME' you fill the page with zram_get_element(zram, index) and return 0. ok.
- for !handle.... you also fill the page with zram_get_element(zram, index) and return 0. is this ok? shouldn't !handle return error in this case?
I really suspect that there are some paths that can lead to !handle entry, that will not be ZRAM_SAME. e.g. error return from compression path.
-ss
> + mem = kmap_atomic(page); > + zram_fill_page(mem, PAGE_SIZE, zram_get_element(zram, index)); > + kunmap_atomic(mem); > + zram_slot_unlock(zram, index); > + return 0; > + } > + > size = zram_get_obj_size(zram, index); > > src = zs_map_object(zram->mem_pool, handle, ZS_MM_RO); > -- > 2.7.4 >
| |