diff options
author | Vitaly Wool <vitalywool@gmail.com> | 2019-07-16 16:25:48 -0700 |
---|---|---|
committer | Linus Torvalds <torvalds@linux-foundation.org> | 2019-07-16 19:23:21 -0700 |
commit | bb9a374dfa3a2f46581455ab66cd1d24c5e3d183 (patch) | |
tree | 654cb71efb841e60b08a23e1f85899eefb1f9e9c /lib/mpi/longlong.h | |
parent | 50950626414a982c8ed539128c7f69a3d328a970 (diff) | |
download | linux-bb9a374dfa3a2f46581455ab66cd1d24c5e3d183.tar.bz2 |
mm/z3fold: don't try to use buddy slots after free
As reported by Henry Burns:
Running z3fold stress testing with address sanitization showed zhdr->slots
was being used after it was freed.
z3fold_free(z3fold_pool, handle)
free_handle(handle)
kmem_cache_free(pool->c_handle, zhdr->slots)
release_z3fold_page_locked_list(kref)
__release_z3fold_page(zhdr, true)
zhdr_to_pool(zhdr)
slots_to_pool(zhdr->slots) *BOOM*
To fix this, add pointer to the pool back to z3fold_header and modify
zhdr_to_pool to return zhdr->pool.
Link: http://lkml.kernel.org/r/20190708134808.e89f3bfadd9f6ffd7eff9ba9@gmail.com
Fixes: 7c2b8baa61fe ("mm/z3fold.c: add structure for buddy handles")
Signed-off-by: Vitaly Wool <vitalywool@gmail.com>
Reported-by: Henry Burns <henryburns@google.com>
Reviewed-by: Shakeel Butt <shakeelb@google.com>
Cc: Jonathan Adams <jwadams@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'lib/mpi/longlong.h')
0 files changed, 0 insertions, 0 deletions