drivers/block/zram/zram_drv.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
From: Longlong Xia <xialonglong@kylinos.cn> Both writeback_store() and read_block_state() derive their table scan bounds from zram->disksize before acquiring dev_lock. If the device is reset and reinitialized with a smaller disksize between that read and lock acquisition, the bound can describe the old table while the scan operates on the new one. This can lead to out-of-bounds slot accesses. Move both bound calculations under dev_lock so each bound remains consistent with the table throughout its scan. Keep the fixes separate because the affected interfaces originate from different commits and can be backported independently. The series has been checked with: scripts/checkpatch.pl --strict <patches> make M=drivers/block/zram modules Longlong Xia (2): zram: fix out-of-bounds access in writeback_store() zram: fix out-of-bounds access in read_block_state() drivers/block/zram/zram_drv.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) base-commit: 848acc8ffe1b7cd5f1bf427b93069becfebc2c9d -- 2.43.0
On Tue, 4 Aug 2026 14:59:17 +0800 Longlong Xia <xialonglong2025@163.com> wrote: > Both writeback_store() and read_block_state() derive their table scan > bounds from zram->disksize before acquiring dev_lock. If the device is > reset and reinitialized with a smaller disksize between that read and lock > acquisition, the bound can describe the old table while the scan operates > on the new one. This can lead to out-of-bounds slot accesses. > > Move both bound calculations under dev_lock so each bound remains > consistent with the table throughout its scan. Keep the fixes separate > because the affected interfaces originate from different commits and can > be backported independently. Thanks. AI review found several things to be worried about, all are pre-existing. https://sashiko.dev/#/patchset/20260804065919.3970386-1-xialonglong2025@163.com
On (26/08/04 13:10), Andrew Morton wrote: > On Tue, 4 Aug 2026 14:59:17 +0800 Longlong Xia <xialonglong2025@163.com> wrote: > > > Both writeback_store() and read_block_state() derive their table scan > > bounds from zram->disksize before acquiring dev_lock. If the device is > > reset and reinitialized with a smaller disksize between that read and lock > > acquisition, the bound can describe the old table while the scan operates > > on the new one. This can lead to out-of-bounds slot accesses. > > > > Move both bound calculations under dev_lock so each bound remains > > consistent with the table throughout its scan. Keep the fixes separate > > because the affected interfaces originate from different commits and can > > be backported independently. > > Thanks. AI review found several things to be worried about, all are > pre-existing. > > https://sashiko.dev/#/patchset/20260804065919.3970386-1-xialonglong2025@163.com - u32 disksize range check is fixed in a separate Longlong Xia's patch. - read_block_state() read of zram->disksize outside of device lock is fixed in this series. - read_block_state() tear-down is something to look into.
© 2016 - 2026 Red Hat, Inc.