diff options
| author | Sergey Senozhatsky <senozhatsky@chromium.org> | 2023-04-17 22:08:50 +0900 |
|---|---|---|
| committer | Andrew Morton <akpm@linux-foundation.org> | 2023-04-18 16:29:42 -0700 |
| commit | f7ddb612568361e04d53fcd984d43d1c32c1294a (patch) | |
| tree | d3e93453b37ba48c5ad598a64d3103b654178920 /mm/zsmalloc.c | |
| parent | 5f300fd59a2ae90b8a7fb5ed3d5fd43768236c38 (diff) | |
zsmalloc: reset compaction source zspage pointer after putback_zspage()
The current implementation of the compaction loop fails to set the source
zspage pointer to NULL in all cases, leading to a potential issue where
__zs_compact() could use a stale zspage pointer. This pointer could even
point to a previously freed zspage, causing unexpected behavior in the
putback_zspage() and migrate_write_unlock() functions after returning from
the compaction loop.
Address the issue by ensuring that the source zspage pointer is always set
to NULL when it should be.
Link: https://lkml.kernel.org/r/20230417130850.1784777-1-senozhatsky@chromium.org
Fixes: 5a845e9f2d66 ("zsmalloc: rework compaction algorithm")
Signed-off-by: Sergey Senozhatsky <senozhatsky@chromium.org>
Reported-by: Yu Zhao <yuzhao@google.com>
Tested-by: Yu Zhao <yuzhao@google.com>
Reviewed-by: Yosry Ahmed <yosryahmed@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Diffstat (limited to 'mm/zsmalloc.c')
| -rw-r--r-- | mm/zsmalloc.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/mm/zsmalloc.c b/mm/zsmalloc.c index aea50e2aa350..cc81dfba05a0 100644 --- a/mm/zsmalloc.c +++ b/mm/zsmalloc.c @@ -2239,8 +2239,8 @@ static unsigned long __zs_compact(struct zs_pool *pool, if (fg == ZS_INUSE_RATIO_0) { free_zspage(pool, class, src_zspage); pages_freed += class->pages_per_zspage; - src_zspage = NULL; } + src_zspage = NULL; if (get_fullness_group(class, dst_zspage) == ZS_INUSE_RATIO_100 || spin_is_contended(&pool->lock)) { |