From: Johannes Weiner <hannes@cmpxchg.org>
Date: Tue, 30 Jan 2024 01:36:40 +0000 (-0500)
Subject: mm: zswap: warn when referencing a dead entry
X-Git-Url: http://git.maquefel.me/?a=commitdiff_plain;h=e477559ca602a033e3970ebdbbfb39773345d694;p=linux.git

mm: zswap: warn when referencing a dead entry

Put a standard sanity check on zswap_entry_get() for UAF scenario.

Link: https://lkml.kernel.org/r/20240130014208.565554-5-hannes@cmpxchg.org
Signed-off-by: Johannes Weiner <hannes@cmpxchg.org>
Reviewed-by: Nhat Pham <nphamcs@gmail.com>
Acked-by: Yosry Ahmed <yosryahmed@google.com>
Reviewed-by: Chengming Zhou <zhouchengming@bytedance.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

diff --git a/mm/zswap.c b/mm/zswap.c
index 0dfd410d1b3c3..70e409add32b2 100644
--- a/mm/zswap.c
+++ b/mm/zswap.c
@@ -541,6 +541,7 @@ static void zswap_entry_free(struct zswap_entry *entry)
 /* caller must hold the tree lock */
 static void zswap_entry_get(struct zswap_entry *entry)
 {
+	WARN_ON_ONCE(!entry->refcount);
 	entry->refcount++;
 }