[PATCH 1/1] zram: reject disksizes that exceed slot index range
Longlong Xia <[email protected]>
| Newsgroups | gmane.linux.block,gmane.linux.kernel,gmane.linux.kernel.stable |
|---|---|
| Message-ID | <[email protected]> |
From: Longlong Xia <[email protected]> zram uses u32 slot indexes, while disksize_store() accepts a u64 size. On 32-bit systems, a disksize larger than U32_MAX pages is truncated when zram_meta_alloc() assigns the page count to size_t. array_size() then sees only the truncated count, so a small table can be allocated while the original capacity is published. Valid I/O within that capacity can subsequently access beyond zram->table. The same oversized capacity also lets full-device scanners compare a u32 index with an upper bound larger than U32_MAX, so the index can wrap instead of terminating. Reject disksizes larger than U32_MAX pages before aligning and allocating the table. This keeps the table size, published capacity and slot index range consistent. Fixes: 33863c21e69e ("Staging: zram: Replace ioctls with sysfs interface") Cc: <[email protected]> Assisted-by: Codex:gpt-5.6-sol Signed-off-by: Longlong Xia <[email protected]> --- drivers/block/zram/zram_drv.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c index ace65c586072..2728a8a826d4 100644 --- a/drivers/block/zram/zram_drv.c +++ b/drivers/block/zram/zram_drv.c @@ -2876,6 +2876,9 @@ static ssize_t disksize_store(struct device *dev, struct device_attribute *attr, return -EBUSY; } + if (disksize > (u64)U32_MAX << PAGE_SHIFT) + return -EINVAL; + disksize = PAGE_ALIGN(disksize); if (!zram_meta_alloc(zram, disksize)) return -ENOMEM; -- 2.43.0