Re: [PATCH 1/2] zram: fix out-of-bounds access in writeback_store()

[Sergey Senozhatsky]

On (26/08/04 14:59), Longlong Xia wrote:
> writeback_store() calculates the table scan bounds before taking
> dev_lock. A reset followed by reconfiguration with a smaller disksize
> can therefore replace zram->table while writeback_store() is waiting for
> the lock. Once it acquires the lock, it sees an initialized device but
> scans the new table using the old upper bound, resulting in an
> out-of-bounds access.
> 
> Calculate the number of pages while holding dev_lock so the scan bound
> matches the table protected by the lock.
> 
> Fixes: a939888ec38b ("zram: support idle/huge page writeback")
> Cc: <stable@xxxxxxxxxxxxxxx>
> Assisted-by: Codex:gpt-5.6-sol
> Signed-off-by: Longlong Xia <xialonglong@xxxxxxxxxx>

Reviewed-by: Sergey Senozhatsky <senozhatsky@xxxxxxxxxxxx>