zram: fix slot write race condition

Parallel concurrent writes to the same zram index result in leaked
zsmalloc handles.  Schematically we can have something like this:

CPU0                              CPU1
zram_slot_lock()
zs_free(handle)
zram_slot_lock()
				zram_slot_lock()
				zs_free(handle)
				zram_slot_lock()

compress			compress
handle = zs_malloc()		handle = zs_malloc()
zram_slot_lock
zram_set_handle(handle)
zram_slot_lock
				zram_slot_lock
				zram_set_handle(handle)
				zram_slot_lock

Either CPU0 or CPU1 zsmalloc handle will leak because zs_free() is done
too early.  In fact, we need to reset zram entry right before we set its
new handle, all under the same slot lock scope.

Link: https://lkml.kernel.org/r/20250909045150.635345-1-senozhatsky@chromium.org
Fixes: 71268035f5d7 ("zram: free slot memory early during write")
Signed-off-by: Sergey Senozhatsky <senozhatsky@chromium.org>
Reported-by: Changhui Zhong <czhong@redhat.com>
Closes: https://lore.kernel.org/all/CAGVVp+UtpGoW5WEdEU7uVTtsSCjPN=ksN6EcvyypAtFDOUf30A@mail.gmail.com/
Tested-by: Changhui Zhong <czhong@redhat.com>
Cc: Jens Axboe <axboe@kernel.dk>
Cc: Minchan Kim <minchan@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>

diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
index 8acad3cc6e6ea16ccef7e898fd840e5994e2264b..f31652085adcb6494543bdeaf191519d2712fdaa 100644 (file)
--- a/drivers/block/zram/zram_drv.c
+++ b/drivers/block/zram/zram_drv.c
@@ -1795,6 +1795,7 @@ static int write_same_filled_page(struct zram *zram, unsigned long fill,
                                  u32 index)
 {
        zram_slot_lock(zram, index);
+       zram_free_page(zram, index);
        zram_set_flag(zram, index, ZRAM_SAME);
        zram_set_handle(zram, index, fill);
        zram_slot_unlock(zram, index);
@@ -1832,6 +1833,7 @@ static int write_incompressible_page(struct zram *zram, struct page *page,
        kunmap_local(src);
 
        zram_slot_lock(zram, index);
+       zram_free_page(zram, index);
        zram_set_flag(zram, index, ZRAM_HUGE);
        zram_set_handle(zram, index, handle);
        zram_set_obj_size(zram, index, PAGE_SIZE);
@@ -1855,11 +1857,6 @@ static int zram_write_page(struct zram *zram, struct page *page, u32 index)
        unsigned long element;
        bool same_filled;
 
-       /* First, free memory allocated to this slot (if any) */
-       zram_slot_lock(zram, index);
-       zram_free_page(zram, index);
-       zram_slot_unlock(zram, index);
-
        mem = kmap_local_page(page);
        same_filled = page_same_filled(mem, &element);
        kunmap_local(mem);
@@ -1901,6 +1898,7 @@ static int zram_write_page(struct zram *zram, struct page *page, u32 index)
        zcomp_stream_put(zstrm);
 
        zram_slot_lock(zram, index);
+       zram_free_page(zram, index);
        zram_set_handle(zram, index, handle);
        zram_set_obj_size(zram, index, comp_len);
        zram_slot_unlock(zram, index);