zram: fix uninitialized ZRAM not releasing backing device

commit 74363ec674cb172d8856de25776c8f3103f05e2f upstream.

Setting backing device is done before ZRAM initialization.  If we set the
backing device, then remove the ZRAM module without initializing the
device, the backing device reference will be leaked and the device will be
hold forever.

Fix this by always reset the ZRAM fully on rmmod or reset store.

Link: https://lkml.kernel.org/r/20241209165717.94215-3-ryncsn@gmail.com
Fixes: 013bf95a83ec ("zram: add interface to specif backing device")
Signed-off-by: Kairui Song <kasong@tencent.com>
Reported-by: Desheng Wu <deshengwu@tencent.com>
Suggested-by: Sergey Senozhatsky <senozhatsky@chromium.org>
Reviewed-by: Sergey Senozhatsky <senozhatsky@chromium.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
index 9fcbaca8e2ad989f3b36b3b7443561e3bf6164f6..bf83a104086ccee87f0fec26c4649eab4705ce1e 100644 (file)
--- a/drivers/block/zram/zram_drv.c
+++ b/drivers/block/zram/zram_drv.c
@@ -1325,12 +1325,16 @@ static void zram_meta_free(struct zram *zram, u64 disksize)
        size_t num_pages = disksize >> PAGE_SHIFT;
        size_t index;
 
+       if (!zram->table)
+               return;
+
        /* Free all pages that are still in this zram device */
        for (index = 0; index < num_pages; index++)
                zram_free_page(zram, index);
 
        zs_destroy_pool(zram->mem_pool);
        vfree(zram->table);
+       zram->table = NULL;
 }
 
 static bool zram_meta_alloc(struct zram *zram, u64 disksize)
@@ -2171,11 +2175,6 @@ static void zram_reset_device(struct zram *zram)
 
        zram->limit_pages = 0;
 
-       if (!init_done(zram)) {
-               up_write(&zram->init_lock);
-               return;
-       }
-
        set_capacity_and_notify(zram->disk, 0);
        part_stat_set_all(zram->disk->part0, 0);