Skip to content

Commit 9ed98c7

Browse files
committed
Merge: zram: fix potential UAF of zram table
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/667 JIRA: https://issues.redhat.com/browse/RHEL-77219 CVE: CVE-2025-21671 Signed-off-by: Ming Lei <[email protected]> Approved-by: Tony Camuso <[email protected]> Approved-by: Jeff Moyer <[email protected]> Approved-by: CKI KWF Bot <[email protected]> Merged-by: Julio Faracco <[email protected]>
2 parents 30c0879 + 631ccd6 commit 9ed98c7

File tree

1 file changed

+5
-5
lines changed

1 file changed

+5
-5
lines changed

drivers/block/zram/zram_drv.c

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1299,12 +1299,16 @@ static void zram_meta_free(struct zram *zram, u64 disksize)
12991299
size_t num_pages = disksize >> PAGE_SHIFT;
13001300
size_t index;
13011301

1302+
if (!zram->table)
1303+
return;
1304+
13021305
/* Free all pages that are still in this zram device */
13031306
for (index = 0; index < num_pages; index++)
13041307
zram_free_page(zram, index);
13051308

13061309
zs_destroy_pool(zram->mem_pool);
13071310
vfree(zram->table);
1311+
zram->table = NULL;
13081312
}
13091313

13101314
static bool zram_meta_alloc(struct zram *zram, u64 disksize)
@@ -1319,6 +1323,7 @@ static bool zram_meta_alloc(struct zram *zram, u64 disksize)
13191323
zram->mem_pool = zs_create_pool(zram->disk->disk_name);
13201324
if (!zram->mem_pool) {
13211325
vfree(zram->table);
1326+
zram->table = NULL;
13221327
return false;
13231328
}
13241329

@@ -2131,11 +2136,6 @@ static void zram_reset_device(struct zram *zram)
21312136

21322137
zram->limit_pages = 0;
21332138

2134-
if (!init_done(zram)) {
2135-
up_write(&zram->init_lock);
2136-
return;
2137-
}
2138-
21392139
set_capacity_and_notify(zram->disk, 0);
21402140
part_stat_set_all(zram->disk->part0, 0);
21412141

0 commit comments

Comments
 (0)