mm: zswap: fix objcg use-after-free in entry destruction
authorJohannes Weiner <hannes@cmpxchg.org>
Tue, 30 Jan 2024 01:34:38 +0000 (20:34 -0500)
committerAndrew Morton <akpm@linux-foundation.org>
Thu, 8 Feb 2024 05:20:35 +0000 (21:20 -0800)
commit2e601e1e8e4b330020a346c55ba111d49e0b188e
tree7516700287f584302bb93ce534f3b67df5405b7d
parent4c2da3188b848d33c26d7f0f8b14f3150331c923
mm: zswap: fix objcg use-after-free in entry destruction

In the per-memcg LRU universe, LRU removal uses entry->objcg to determine
which list count needs to be decreased.  Drop the objcg reference after
updating the LRU, to fix a possible use-after-free.

Link: https://lkml.kernel.org/r/20240130013438.565167-1-hannes@cmpxchg.org
Fixes: a65b0e7607cc ("zswap: make shrinking memcg-aware")
Signed-off-by: Johannes Weiner <hannes@cmpxchg.org>
Acked-by: Yosry Ahmed <yosryahmed@google.com>
Reviewed-by: Nhat Pham <nphamcs@gmail.com>
Reviewed-by: Chengming Zhou <zhouchengming@bytedance.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
mm/zswap.c