ANDROID: zram: ioctl: Ignore swap entries from other devices
The zram_process_walker() iterates over a process's page tables to
identify swap entries backed by a zram device for writeback. It
extracts the offset from each swap entry to locate the corresponding
page in the zram device.
A process can have pages swapped out to multiple different swap devices.
The walker did not verify that a found swap entry actually belongs to
the zram device being operated on.
If the walker encounters a swap entry from a different swap device, it
could use an offset that is larger than the current zram device's size,
leading to an out-of-bounds memory access.
Fix this by first checking that the swap entry's backing device matches
the current zram device. Then, add a range check to ensure the offset is
within the valid range before using it.
Bug: 447017656
Change-Id: Ic74688f21b7cd96408bfdfd2fe1a0acac52517da
Signed-off-by:
Richard Chang <richardycc@google.com>
Loading