From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751458AbdISFjl (ORCPT ); Tue, 19 Sep 2017 01:39:41 -0400 Received: from mail-pg0-f46.google.com ([74.125.83.46]:48776 "EHLO mail-pg0-f46.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750713AbdISFjk (ORCPT ); Tue, 19 Sep 2017 01:39:40 -0400 X-Google-Smtp-Source: AOwi7QAcBefi1QQDVnQW6Zv18yNvpRXfiM3Ya6bQ/Tlo+gd4z1JgBr0DrX6ENybHpnEUunM3tQzlxg== Date: Tue, 19 Sep 2017 14:39:35 +0900 From: Sergey Senozhatsky To: Minchan Kim Cc: Andrew Morton , linux-kernel@vger.kernel.org, kernel-team , Sergey Senozhatsky Subject: Re: [PATCH] zram: fix null dereference of handle Message-ID: <20170919053934.GC16991@jagdpanzerIV.localdomain> References: <1505788488-26723-1-git-send-email-minchan@kernel.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1505788488-26723-1-git-send-email-minchan@kernel.org> User-Agent: Mutt/1.9.0 (2017-09-02) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On (09/19/17 11:34), Minchan Kim wrote: [..] > static void zram_meta_free(struct zram *zram, u64 disksize) > { > size_t num_pages = disksize >> PAGE_SHIFT; > @@ -876,11 +855,18 @@ static int __zram_bvec_read(struct zram *zram, struct page *page, u32 index, > zram_slot_unlock(zram, index); > } > > - if (zram_same_page_read(zram, index, page, 0, PAGE_SIZE)) > - return 0; > - > zram_slot_lock(zram, index); > handle = zram_get_handle(zram, index); > + if (unlikely(!handle || zram_test_flag(zram, index, ZRAM_SAME))) { > + void *mem; is this branch really unlikely()? ZRAM_SAME ratio really depends, on some setups it can be quite likely, I suspect. another question, "!handle == value & ZRAM_SAME"? if so, then why not just check for `flags & ZRAM_SAME'? if not then: - for `value & ZRAM_SAME' you fill the page with zram_get_element(zram, index) and return 0. ok. - for !handle.... you also fill the page with zram_get_element(zram, index) and return 0. is this ok? shouldn't !handle return error in this case? I really suspect that there are some paths that can lead to !handle entry, that will not be ZRAM_SAME. e.g. error return from compression path. -ss > + mem = kmap_atomic(page); > + zram_fill_page(mem, PAGE_SIZE, zram_get_element(zram, index)); > + kunmap_atomic(mem); > + zram_slot_unlock(zram, index); > + return 0; > + } > + > size = zram_get_obj_size(zram, index); > > src = zs_map_object(zram->mem_pool, handle, ZS_MM_RO); > -- > 2.7.4 >