[alternative-merged] zram-reject-disksizes-that-exceed-slot-index-range.patch removed from -mm tree

Andrew Morton <[email protected]>
Newsgroups org.kernel.vger.stable,org.kernel.vger.mm-commits
Message-ID <[email protected]>
The quilt patch titled
     Subject: zram: reject disksizes that exceed slot index range
has been removed from the -mm tree.  Its filename was
     zram-reject-disksizes-that-exceed-slot-index-range.patch

This patch was dropped because an alternative patch was or shall be merged

------------------------------------------------------
From: Longlong Xia <[email protected]>
Subject: zram: reject disksizes that exceed slot index range
Date: Tue, 4 Aug 2026 22:38:32 +0800

zram uses u32 slot indexes, while disksize_store() accepts a u64 size.  On
32-bit systems, a disksize larger than U32_MAX pages is truncated when
zram_meta_alloc() assigns the page count to size_t.  array_size() then
sees only the truncated count, so a small table can be allocated while the
original capacity is published.  Valid I/O within that capacity can
subsequently access beyond zram->table.

The same oversized capacity also lets full-device scanners compare a u32
index with an upper bound larger than U32_MAX, so the index can wrap
instead of terminating.

Reject disksizes larger than U32_MAX pages before aligning and allocating
the table.  This keeps the table size, published capacity and slot index
range consistent.

Link: https://lore.kernel.org/[email protected]
Fixes: 33863c21e69e ("Staging: zram: Replace ioctls with sysfs interface")
Assisted-by: Codex:gpt-5.6-sol
Signed-off-by: Longlong Xia <[email protected]>
Reviewed-by: Sergey Senozhatsky <[email protected]>
Cc: <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
---

 drivers/block/zram/zram_drv.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/drivers/block/zram/zram_drv.c~zram-reject-disksizes-that-exceed-slot-index-range
+++ a/drivers/block/zram/zram_drv.c
@@ -2881,6 +2881,9 @@ static ssize_t disksize_store(struct dev
 		return -EBUSY;
 	}
 
+	if (disksize > (u64)U32_MAX << PAGE_SHIFT)
+		return -EINVAL;
+
 	disksize = PAGE_ALIGN(disksize);
 	if (!zram_meta_alloc(zram, disksize))
 		return -ENOMEM;
_

Patches currently in -mm which might be from [email protected] are

mm-ksm-avoid-missing-ksmd-wakeups-in-ksm_enter.patch
zram-fix-out-of-bounds-access-in-writeback_store.patch
zram-fix-out-of-bounds-access-in-read_block_state.patch
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.