[alternative-merged] zram-reject-disksizes-that-exceed-slot-index-range.patch removed from -mm tree
Andrew Morton <[email protected]>
| Newsgroups | org.kernel.vger.stable,org.kernel.vger.mm-commits |
|---|---|
| Message-ID | <[email protected]> |
The quilt patch titled
Subject: zram: reject disksizes that exceed slot index range
has been removed from the -mm tree. Its filename was
zram-reject-disksizes-that-exceed-slot-index-range.patch
This patch was dropped because an alternative patch was or shall be merged
------------------------------------------------------
From: Longlong Xia <[email protected]>
Subject: zram: reject disksizes that exceed slot index range
Date: Tue, 4 Aug 2026 22:38:32 +0800
zram uses u32 slot indexes, while disksize_store() accepts a u64 size. On
32-bit systems, a disksize larger than U32_MAX pages is truncated when
zram_meta_alloc() assigns the page count to size_t. array_size() then
sees only the truncated count, so a small table can be allocated while the
original capacity is published. Valid I/O within that capacity can
subsequently access beyond zram->table.
The same oversized capacity also lets full-device scanners compare a u32
index with an upper bound larger than U32_MAX, so the index can wrap
instead of terminating.
Reject disksizes larger than U32_MAX pages before aligning and allocating
the table. This keeps the table size, published capacity and slot index
range consistent.
Link: https://lore.kernel.org/[email protected]
Fixes: 33863c21e69e ("Staging: zram: Replace ioctls with sysfs interface")
Assisted-by: Codex:gpt-5.6-sol
Signed-off-by: Longlong Xia <[email protected]>
Reviewed-by: Sergey Senozhatsky <[email protected]>
Cc: <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
---
drivers/block/zram/zram_drv.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/block/zram/zram_drv.c~zram-reject-disksizes-that-exceed-slot-index-range
+++ a/drivers/block/zram/zram_drv.c
@@ -2881,6 +2881,9 @@ static ssize_t disksize_store(struct dev
return -EBUSY;
}
+ if (disksize > (u64)U32_MAX << PAGE_SHIFT)
+ return -EINVAL;
+
disksize = PAGE_ALIGN(disksize);
if (!zram_meta_alloc(zram, disksize))
return -ENOMEM;
_
Patches currently in -mm which might be from [email protected] are
mm-ksm-avoid-missing-ksmd-wakeups-in-ksm_enter.patch
zram-fix-out-of-bounds-access-in-writeback_store.patch
zram-fix-out-of-bounds-access-in-read_block_state.patch