hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAFWQ ---------------------------------------- zspool_mm_stat_show() takes pool without init_lock held, it may race with disksize_store(), and lead to NULL-ptr dereference. The race is as follows. CPU0 (zspool_mm_stat_show) CPU1 (disksize_store) pool = zram->mem_pool[pool_index]; // NULL zram_meta_alloc() zram->disksize = disksize; if (init_done(zram)) // true zs_get_total_pages(pool);// NULL-ptr dereference To fix it, zspool_mm_stat_show() takes pool under init_lock, to avoid race with disksize_store(). Fixes: 44bffb3bd10b ("[Huawei] multi_pool_zram: add mm_stat interface for each zspool") Signed-off-by: Jinjiang Tu <tujinjiang@huawei.com> --- drivers/block/multi_pool_zram/multi_pool_zram_drv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/block/multi_pool_zram/multi_pool_zram_drv.c b/drivers/block/multi_pool_zram/multi_pool_zram_drv.c index 85534cede5a3..c498b57b82b7 100644 --- a/drivers/block/multi_pool_zram/multi_pool_zram_drv.c +++ b/drivers/block/multi_pool_zram/multi_pool_zram_drv.c @@ -1175,12 +1175,12 @@ static ssize_t zspool_mm_stat_show(struct device *dev, zram = dev_to_zram(kobj_to_dev(kobj->parent->parent)); pool_index = kobj_to_pool_index(zram, kobj); - pool = zram->mem_pool[pool_index]; zram_zspool_stats = &zram->zspool_stats[pool_index]; memset(&pool_stats, 0x0, sizeof(struct zs_pool_stats)); down_read(&zram->init_lock); if (init_done(zram)) { + pool = zram->mem_pool[pool_index]; mem_used = zs_get_total_pages(pool); zs_pool_stats(pool, &pool_stats); } -- 2.43.0