From e62ddebbde53415f79fc08e08e64ad9d9e945ca6 Mon Sep 17 00:00:00 2001 From: Kairui Song Date: Fri, 14 Mar 2025 12:03:09 +0900 Subject: [PATCH] zram: fix potential UAF of zram table BugLink: https://bugs.launchpad.net/bugs/2102266 commit 212fe1c0df4a150fb6298db2cfff267ceaba5402 upstream. If zram_meta_alloc failed early, it frees allocated zram->table without setting it NULL. Which will potentially cause zram_meta_free to access the table if user reset an failed and uninitialized device. Link: https://lkml.kernel.org/r/20250107065446.86928-1-ryncsn@gmail.com Fixes: 74363ec674cb ("zram: fix uninitialized ZRAM not releasing backing device") Signed-off-by: Kairui Song Reviewed-by: Sergey Senozhatsky Cc: Signed-off-by: Andrew Morton Signed-off-by: Greg Kroah-Hartman (cherry picked from commit 571d3f6045cd3a6d9f6aec33b678f3ffe97582ef linux-6.6.y) [koichiroden: follow-up fix from v6.6.70] Signed-off-by: Koichiro Den Signed-off-by: Mehmet Basaran --- drivers/block/zram/zram_drv.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c index 66bf7010b5b0..f2c1aca26df0 100644 --- a/drivers/block/zram/zram_drv.c +++ b/drivers/block/zram/zram_drv.c @@ -1266,6 +1266,7 @@ static bool zram_meta_alloc(struct zram *zram, u64 disksize) zram->mem_pool = zs_create_pool(zram->disk->disk_name); if (!zram->mem_pool) { vfree(zram->table); + zram->table = NULL; return false; }