Commit 92d3ba8b authored by Richard Chang's avatar Richard Chang Committed by David Stevens
Browse files

ANDROID: zram: ioctl: Ignore swap entries from other devices



The zram_process_walker() iterates over a process's page tables to
identify swap entries backed by a zram device for writeback. It
extracts the offset from each swap entry to locate the corresponding
page in the zram device.

A process can have pages swapped out to multiple different swap devices.
The walker did not verify that a found swap entry actually belongs to
the zram device being operated on.

If the walker encounters a swap entry from a different swap device, it
could use an offset that is larger than the current zram device's size,
leading to an out-of-bounds memory access.

Fix this by first checking that the swap entry's backing device matches
the current zram device. Then, add a range check to ensure the offset is
within the valid range before using it.

Bug: 447017656
Change-Id: Ic74688f21b7cd96408bfdfd2fe1a0acac52517da
Signed-off-by: default avatarRichard Chang <richardycc@google.com>
(cherry picked from commit 85036a95)
Bug: 446676432
Signed-off-by: default avatarDavid Stevens <stevensd@google.com>
parent bc60d1da
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please to comment