All of lore.kernel.org
 help / color / mirror / Atom feed
From: Jiang Liu <liuj97@gmail.com>
To: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	Nitin Gupta <ngupta@vflare.org>, Minchan Kim <minchan@kernel.org>,
	Jerome Marchand <jmarchan@redhat.com>
Cc: Yijing Wang <wangyijing@huawei.com>,
	Jiang Liu <jiang.liu@huawei.com>,
	devel@driverdev.osuosl.org, linux-kernel@vger.kernel.org
Subject: [PATCH v2 08/10] zram: protect sysfs handler from invalid memory access
Date: Wed,  5 Jun 2013 00:06:06 +0800	[thread overview]
Message-ID: <1370361968-8764-8-git-send-email-jiang.liu@huawei.com> (raw)
In-Reply-To: <1370361968-8764-1-git-send-email-jiang.liu@huawei.com>

Use zram->init_lock to protect access to zram->meta, otherwise it
may cause invalid memory access if zram->meta has been freed by
zram_reset_device().

This issue may be triggered by:
Thread 1:
while true; do cat mem_used_total; done
Thread 2:
while true; do echo 8M > disksize; echo 1 > reset; done

Signed-off-by: Jiang Liu <jiang.liu@huawei.com>
Cc: stable@vger.kernel.org
---
 drivers/staging/zram/zram_sysfs.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/staging/zram/zram_sysfs.c b/drivers/staging/zram/zram_sysfs.c
index 8cb7822..e239d94 100644
--- a/drivers/staging/zram/zram_sysfs.c
+++ b/drivers/staging/zram/zram_sysfs.c
@@ -179,8 +179,10 @@ static ssize_t mem_used_total_show(struct device *dev,
 	struct zram *zram = dev_to_zram(dev);
 	struct zram_meta *meta = zram->meta;
 
+	down_read(&zram->init_lock);
 	if (zram->init_done)
 		val = zs_get_total_size_bytes(meta->mem_pool);
+	up_read(&zram->init_lock);
 
 	return sprintf(buf, "%llu\n", val);
 }
-- 
1.8.1.2


  parent reply	other threads:[~2013-06-04 16:09 UTC|newest]

Thread overview: 32+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2013-06-04 16:05 [PATCH v2 01/10] zram: kill unused zram_get_num_devices() Jiang Liu
2013-06-04 16:06 ` [PATCH v2 02/10] zram: avoid invalid memory access in zram_exit() Jiang Liu
2013-06-05  6:04   ` Minchan Kim
2013-06-05 15:24     ` Jiang Liu
2013-06-04 16:06 ` [PATCH v2 03/10] zram: use zram->lock to protect zram_free_page() in swap free notify path Jiang Liu
2013-06-05  6:29   ` Minchan Kim
2013-06-05 16:00     ` Jiang Liu
2013-06-05 10:26   ` Jerome Marchand
2013-06-04 16:06 ` [PATCH v2 04/10] zram: destroy all devices on error recovery path in zram_init() Jiang Liu
2013-06-05  6:40   ` Minchan Kim
2013-06-05 10:40   ` Jerome Marchand
2013-06-04 16:06 ` [PATCH v2 05/10] zram: avoid double free in function zram_bvec_write() Jiang Liu
2013-06-05  6:41   ` Minchan Kim
2013-06-07  9:35   ` Jerome Marchand
2013-06-04 16:06 ` [PATCH v2 06/10] zram: avoid access beyond the zram device Jiang Liu
2013-06-05  6:43   ` Minchan Kim
2013-06-04 16:06 ` [PATCH v2 07/10] zram: optimize memory operations with clear_page()/copy_page() Jiang Liu
2013-06-05  6:57   ` Minchan Kim
2013-06-04 16:06 ` Jiang Liu [this message]
2013-06-05  7:03   ` [PATCH v2 08/10] zram: protect sysfs handler from invalid memory access Minchan Kim
2013-06-04 16:06 ` [PATCH v2 09/10] zram: minor code cleanup Jiang Liu
2013-06-05  7:13   ` Minchan Kim
2013-06-04 16:06 ` [PATCH v2 10/10] zram: use atomic64_xxx() to replace zram_stat64_xxx() Jiang Liu
2013-06-05 12:02   ` Jerome Marchand
2013-06-05 16:21     ` Jiang Liu
2013-06-06  9:37       ` Jerome Marchand
2013-06-06 14:36         ` Jiang Liu
2013-06-06 15:07           ` Jerome Marchand
2013-06-06 15:56             ` Jiang Liu
2013-06-05  5:52 ` [PATCH v2 01/10] zram: kill unused zram_get_num_devices() Minchan Kim
2013-06-05 15:09   ` Jiang Liu
2013-06-05  9:06 ` Jerome Marchand

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1370361968-8764-8-git-send-email-jiang.liu@huawei.com \
    --to=liuj97@gmail.com \
    --cc=devel@driverdev.osuosl.org \
    --cc=gregkh@linuxfoundation.org \
    --cc=jiang.liu@huawei.com \
    --cc=jmarchan@redhat.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=minchan@kernel.org \
    --cc=ngupta@vflare.org \
    --cc=wangyijing@huawei.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.