| Message ID | 1373022086-23362-1-git-send-email-luis.henriques@canonical.com |
|---|---|
| State | New |
| Headers | show |
diff --git a/drivers/staging/zram/zram_drv.c b/drivers/staging/zram/zram_drv.c index fb7f9fb..900f0ed 100644 --- a/drivers/staging/zram/zram_drv.c +++ b/drivers/staging/zram/zram_drv.c @@ -841,9 +841,11 @@ static void __exit zram_exit(void) for (i = 0; i < num_devices; i++) { zram = &zram_devices[i]; + get_disk(zram->disk); destroy_device(zram); if (zram->init_done) zram_reset_device(zram); + put_disk(zram->disk); } unregister_blkdev(zram_major, "zram");
This is a note to let you know that I have just added a patch titled zram: avoid invalid memory access in zram_exit() to the linux-3.5.y-queue branch of the 3.5.y.z extended stable tree which can be found at: http://kernel.ubuntu.com/git?p=ubuntu/linux.git;a=shortlog;h=refs/heads/linux-3.5.y-queue If you, or anyone else, feels it should not be added to this tree, please reply to this email. For more information about the 3.5.y.z tree, see https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable Thanks. -Luis ------ From 8749b459a8f04f95ddae5b2a074de23b98aa7440 Mon Sep 17 00:00:00 2001 From: Jiang Liu <liuj97@gmail.com> Date: Fri, 7 Jun 2013 00:07:22 +0800 Subject: [PATCH] zram: avoid invalid memory access in zram_exit() commit 6030ea9b35971a4200062f010341ab832e878ac9 upstream. Memory for zram->disk object may have already been freed after returning from destroy_device(zram), then it's unsafe for zram_reset_device(zram) to access zram->disk again. We can't solve this bug by flipping the order of destroy_device(zram) and zram_reset_device(zram), that will cause deadlock issues to the zram sysfs handler. So fix it by holding an extra reference to zram->disk before calling destroy_device(zram). Signed-off-by: Jiang Liu <jiang.liu@huawei.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> [ luis: backported to 3.5: adjusted context ] Signed-off-by: Luis Henriques <luis.henriques@canonical.com> --- drivers/staging/zram/zram_drv.c | 2 ++ 1 file changed, 2 insertions(+) -- 1.8.1.2