Skip to content

Commit 212fe1c

Browse files
ryncsnakpm00
authored andcommitted
zram: fix potential UAF of zram table
If zram_meta_alloc failed early, it frees allocated zram->table without setting it NULL. Which will potentially cause zram_meta_free to access the table if user reset an failed and uninitialized device. Link: https://lkml.kernel.org/r/[email protected] Fixes: 74363ec ("zram: fix uninitialized ZRAM not releasing backing device") Signed-off-by: Kairui Song <[email protected]> Reviewed-by: Sergey Senozhatsky <[email protected]> Cc: <[email protected]> Signed-off-by: Andrew Morton <[email protected]>
1 parent a32bf5b commit 212fe1c

File tree

1 file changed

+1
-0
lines changed

1 file changed

+1
-0
lines changed

drivers/block/zram/zram_drv.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1468,6 +1468,7 @@ static bool zram_meta_alloc(struct zram *zram, u64 disksize)
14681468
zram->mem_pool = zs_create_pool(zram->disk->disk_name);
14691469
if (!zram->mem_pool) {
14701470
vfree(zram->table);
1471+
zram->table = NULL;
14711472
return false;
14721473
}
14731474

0 commit comments

Comments
 (0)