REDHAT-BUG-2492735: Use After Free
In the Linux kernel, the following vulnerability has been resolved:
zram: fix use-after-free in zrambvecwritepartial()
zramreadpage() picks the sync or async backing device read path based on whether the parent bio is NULL. zrambvecwritepartial() passes its parent bio down, so for ZRAMWB slots the read is dispatched asynchronously and zramreadpage() returns 0 while the bio is still in flight. The caller then runs memcpyfrombvec(), zramwritepage() and freepage() on the buffer, leaving the async read to write into a freed page.
zrambvecreadpartial() was switched to NULL in commit 4e3c87b9421d ("zram: fix synchronous reads") for the same reason; the writepartial counterpart was missed.
Affected Software
Event History
Frequently Asked Questions
Which zram activity is affected by this issue?
The issue occurs in zram_bvec_write_partial() when handling ZRAM_WB slots. That path passes a parent bio to zram_read_page(), causing an asynchronous backing-device read while the buffer can subsequently be freed.
Is there a related read-path fix that helps identify the intended behavior?
Yes. zram_bvec_read_partial() was changed to pass NULL through commit 4e3c87b9421d, which forces the synchronous read behavior. The write_partial counterpart was missed until this vulnerability was resolved.