From: Andrey Skvortsov andrej.skvortzov@gmail.com
stable inclusion from stable-v6.6.57 commit 6e20720b12299595154857fa98222729f0d5823c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRI0 CVE: CVE-2024-50064
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=...
--------------------------------
[ Upstream commit 486fd58af7ac1098b68370b1d4d9f94a2a1c7124 ]
When CONFIG_ZRAM_MULTI_COMP isn't set ZRAM_SECONDARY_COMP can hold default_compressor, because it's the same offset as ZRAM_PRIMARY_COMP, so we need to make sure that we don't attempt to kfree() the statically defined compressor name.
This is detected by KASAN.
================================================================== Call trace: kfree+0x60/0x3a0 zram_destroy_comps+0x98/0x198 [zram] zram_reset_device+0x22c/0x4a8 [zram] reset_store+0x1bc/0x2d8 [zram] dev_attr_store+0x44/0x80 sysfs_kf_write+0xfc/0x188 kernfs_fop_write_iter+0x28c/0x428 vfs_write+0x4dc/0x9b8 ksys_write+0x100/0x1f8 __arm64_sys_write+0x74/0xb8 invoke_syscall+0xd8/0x260 el0_svc_common.constprop.0+0xb4/0x240 do_el0_svc+0x48/0x68 el0_svc+0x40/0xc8 el0t_64_sync_handler+0x120/0x130 el0t_64_sync+0x190/0x198 ==================================================================
Link: https://lkml.kernel.org/r/20240923164843.1117010-1-andrej.skvortzov@gmail.co... Fixes: 684826f8271a ("zram: free secondary algorithms names") Signed-off-by: Andrey Skvortsov andrej.skvortzov@gmail.com Reviewed-by: Sergey Senozhatsky senozhatsky@chromium.org Reported-by: Venkat Rao Bagalkote venkat88@linux.vnet.ibm.com Closes: https://lore.kernel.org/lkml/57130e48-dbb6-4047-a8c7-ebf5aaea93f4@linux.vnet... Tested-by: Venkat Rao Bagalkote venkat88@linux.vnet.ibm.com Cc: Christophe JAILLET christophe.jaillet@wanadoo.fr Cc: Jens Axboe axboe@kernel.dk Cc: Minchan Kim minchan@kernel.org Cc: Sergey Senozhatsky senozhatsky@chromium.org Cc: Venkat Rao Bagalkote venkat88@linux.vnet.ibm.com Cc: Chris Li chrisl@kernel.org Signed-off-by: Andrew Morton akpm@linux-foundation.org Signed-off-by: Sasha Levin sashal@kernel.org Signed-off-by: Tong Tiangen tongtiangen@huawei.com --- drivers/block/zram/zram_drv.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c index 494ede9d380c..1ffc53ff5ecc 100644 --- a/drivers/block/zram/zram_drv.c +++ b/drivers/block/zram/zram_drv.c @@ -1981,8 +1981,10 @@ static void zram_destroy_comps(struct zram *zram) zram->num_active_comps--; }
- for (prio = ZRAM_SECONDARY_COMP; prio < ZRAM_MAX_COMPS; prio++) { - kfree(zram->comp_algs[prio]); + for (prio = ZRAM_PRIMARY_COMP; prio < ZRAM_MAX_COMPS; prio++) { + /* Do not free statically defined compression algorithms */ + if (zram->comp_algs[prio] != default_compressor) + kfree(zram->comp_algs[prio]); zram->comp_algs[prio] = NULL; } }