linux.git/drivers/staging/zram, branch v3.12.65

zram: avoid kunmap_atomic() of a NULL pointer

2014-11-19T17:38:14+00:00

commit c406515239376fc93a30d5d03192182160cbd3fb upstream.

zram could kunmap_atomic() a NULL pointer in a rare situation: a zram
page becomes a full-zeroed page after a partial write io.  The current
code doesn't handle this case and performs kunmap_atomic() on a NULL
pointer, which panics the kernel.

This patch fixes this issue.

Signed-off-by: Weijie Yang 
Cc: Sergey Senozhatsky 
Cc: Dan Streetman 
Cc: Nitin Gupta 
Cc: Weijie Yang 
Acked-by: Jerome Marchand 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Jiri Slaby

zram: avoid null access when fail to alloc meta

2014-03-22T21:01:47+00:00

commit db5d711e2db776f18219b033e5dc4fb7e4264dd7 upstream.

zram_meta_alloc could fail so caller should check it.  Otherwise, your
system will hang.

Signed-off-by: Minchan Kim 
Acked-by: Jerome Marchand 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Jiri Slaby

zram: fix race between reset and flushing pending work

2014-02-06T19:22:19+00:00

commit da4a04126baa3be03bc566d4a2ee0944c5e783d0 upstream.

Dan and Sergey reported that there is a racy between reset and flushing
of pending work so that it could make oops by freeing zram->meta in
reset while zram_slot_free can access zram->meta if new request is
adding during the race window.

This patch moves flush after taking init_lock so it prevents new request
so that it closes the race.

Signed-off-by: Minchan Kim 
Reported-by: Dan Carpenter 
Cc: Nitin Gupta 
Cc: Jerome Marchand 
Tested-by: Sergey Senozhatsky 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman

Staging: zram: Fix memory leak by refcount mismatch

2013-12-04T19:05:08+00:00

commit 1b672224d128ec2570eb37572ff803cfe452b4f7 upstream.

As suggested by Minchan Kim and Jerome Marchand "The code in reset_store
get the block device (bdget_disk()) but it does not put it (bdput()) when
it's done using it. The usage count is therefore incremented but never
decremented."

This patch also puts bdput() for all error cases.

Acked-by: Minchan Kim 
Acked-by: Jerome Marchand 
Signed-off-by: Rashika Kheria 
Signed-off-by: Greg Kroah-Hartman

Staging: zram: Fix access of NULL pointer

2013-11-29T19:27:56+00:00

commit 46a51c80216cb891f271ad021f59009f34677499 upstream.

This patch fixes the bug in reset_store caused by accessing NULL pointer.

The bdev gets its value from bdget_disk() which could fail when memory
pressure is severe and hence can return NULL because allocation of
inode in bdget could fail.

Hence, this patch introduces a check for bdev to prevent reference to a
NULL pointer in the later part of the code. It also removes unnecessary
check of bdev for fsync_bdev().

Acked-by: Jerome Marchand 
Signed-off-by: Rashika Kheria 
Acked-by: Minchan Kim 
Signed-off-by: Greg Kroah-Hartman

Revert "staging: zram: Add auto loading of module if user opens /dev/zram."

2013-09-17T14:39:28+00:00

This reverts commit c70bda992c12e593e411c02a52e4bd6985407539.

It's incorrect, Kay writes:
	Please just remove it. "devname" is meant to be used for
	single-instance devices with a static dev_t, never for things
	like zramX.

	It will not do anything useful here, it does nothing really
	without a statically assigned dev_t, and it should not be used
	for devices of this kind anyway.

Reported-by: Tom Gundersen 
Reported-by: Kay Sievers 
Cc: Minchan Kim 
Cc: Konrad Rzeszutek Wilk 
Signed-off-by: Greg Kroah-Hartman

zram: don't grab mutex in zram_slot_free_noity

2013-08-12T22:25:00+00:00

[1] introduced down_write in zram_slot_free_notify to prevent race
between zram_slot_free_notify and zram_bvec_[read|write]. The race
could happen if somebody who has right permission to open swap device
is reading swap device while it is used by swap in parallel.

However, zram_slot_free_notify is called with holding spin_lock of
swap layer so we shouldn't avoid holing mutex. Otherwise, lockdep
warns it.

This patch adds new list to handle free slot and workqueue
so zram_slot_free_notify just registers slot index to be freed and
registers the request to workqueue. If workqueue is expired,
it holds mutex_lock so there is no problem any more.

If any I/O is issued, zram handles pending slot-free request
caused by zram_slot_free_notify right before handling issued
request because workqueue wouldn't be expired yet so zram I/O
request handling function can miss it.

Lastly, when zram is reset, flush_work could handle all of pending
free request so we shouldn't have memory leak.

NOTE: If zram_slot_free_notify's kmalloc with GFP_ATOMIC would be
failed, the slot will be freed when next write I/O write the slot.

[1] [57ab0485, zram: use zram->lock to protect zram_free_page()
    in swap free notify path]

* from v2
  * refactoring

* from v1
  * totally redesign

Cc: Nitin Gupta 
Cc: Jiang Liu 
Cc: stable@vger.kernel.org
Signed-off-by: Minchan Kim 
Signed-off-by: Greg Kroah-Hartman

zram: fix invalid memory access

2013-08-12T22:24:59+00:00

[1] tried to fix invalid memory access on zram->disk but it didn't
fix properly because get_disk failed during module exit path.

Actually, we don't need to reset zram->disk's capacity to zero
in module exit path so that this patch introduces new argument
"reset_capacity" on zram_reset_divice and it only reset it when
reset_store is called.

[1] 6030ea9b,  zram: avoid invalid memory access in zram_exit()

Cc: Nitin Gupta 
Cc: Jiang Liu 
Cc: stable@vger.kernel.org
Signed-off-by: Minchan Kim 
Signed-off-by: Greg Kroah-Hartman

Staging: zram: zram_drv.c: Fixed Error of trailing whitespace

2013-08-12T22:20:25+00:00

Fixed by removing trailing whitespace

Signed-off-by: Kumar Gaurav 
Signed-off-by: Greg Kroah-Hartman

Merge 3.11-rc3 into staging-next

2013-07-29T14:40:10+00:00

We want these fixes here.

Signed-off-by: Greg Kroah-Hartman