zram: fix slot write race condition

commit ce4be9e4307c5a60701ff6e0cafa74caffdc54ce upstream.

Parallel concurrent writes to the same zram index result in leaked
zsmalloc handles.  Schematically we can have something like this:

CPU0                              CPU1
zram_slot_lock()
zs_free(handle)
zram_slot_lock()
				zram_slot_lock()
				zs_free(handle)
				zram_slot_lock()

compress			compress
handle = zs_malloc()		handle = zs_malloc()
zram_slot_lock
zram_set_handle(handle)
zram_slot_lock
				zram_slot_lock
				zram_set_handle(handle)
				zram_slot_lock

Either CPU0 or CPU1 zsmalloc handle will leak because zs_free() is done
too early.  In fact, we need to reset zram entry right before we set its
new handle, all under the same slot lock scope.

Link: https://lkml.kernel.org/r/20250909045150.635345-1-senozhatsky@chromium.org
Fixes: 71268035f5d7 ("zram: free slot memory early during write")
Signed-off-by: Sergey Senozhatsky <senozhatsky@chromium.org>
Reported-by: Changhui Zhong <czhong@redhat.com>
Closes: https://lore.kernel.org/all/CAGVVp+UtpGoW5WEdEU7uVTtsSCjPN=ksN6EcvyypAtFDOUf30A@mail.gmail.com/
Tested-by: Changhui Zhong <czhong@redhat.com>
Cc: Jens Axboe <axboe@kernel.dk>
Cc: Minchan Kim <minchan@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
index 54c57103715f9b1af25f513d13d2dc8a98bde71e..0f7bcc86b6f7243412c86bf1aa79759ee708f657 100644 (file)
--- a/drivers/block/zram/zram_drv.c
+++ b/drivers/block/zram/zram_drv.c
@@ -1794,6 +1794,7 @@ static int write_same_filled_page(struct zram *zram, unsigned long fill,
                                  u32 index)
 {
        zram_slot_lock(zram, index);
+       zram_free_page(zram, index);
        zram_set_flag(zram, index, ZRAM_SAME);
        zram_set_handle(zram, index, fill);
        zram_slot_unlock(zram, index);
@@ -1831,6 +1832,7 @@ static int write_incompressible_page(struct zram *zram, struct page *page,
        kunmap_local(src);
 
        zram_slot_lock(zram, index);
+       zram_free_page(zram, index);
        zram_set_flag(zram, index, ZRAM_HUGE);
        zram_set_handle(zram, index, handle);
        zram_set_obj_size(zram, index, PAGE_SIZE);
@@ -1854,11 +1856,6 @@ static int zram_write_page(struct zram *zram, struct page *page, u32 index)
        unsigned long element;
        bool same_filled;
 
-       /* First, free memory allocated to this slot (if any) */
-       zram_slot_lock(zram, index);
-       zram_free_page(zram, index);
-       zram_slot_unlock(zram, index);
-
        mem = kmap_local_page(page);
        same_filled = page_same_filled(mem, &element);
        kunmap_local(mem);
@@ -1900,6 +1897,7 @@ static int zram_write_page(struct zram *zram, struct page *page, u32 index)
        zcomp_stream_put(zstrm);
 
        zram_slot_lock(zram, index);
+       zram_free_page(zram, index);
        zram_set_handle(zram, index, handle);
        zram_set_obj_size(zram, index, comp_len);
        zram_slot_unlock(zram, index);