[PATCH] zram: reject disksize values that overflow PAGE_ALIGN

[PATCH] zram: reject disksize values that overflow PAGE_ALIGN

[Jiacheng Xu]

disksize_store() parses the value written to the disksize sysfs
attribute with memparse() and then aligns it with PAGE_ALIGN().

For values in the last PAGE_SIZE - 1 bytes of the u64 range, the
addition performed by PAGE_ALIGN() wraps around.  For example,
U64_MAX - 3 is aligned to zero.  zram_meta_alloc() then calls
vzalloc(0), which triggers a warning in __vmalloc_node_range().

With panic_on_warn enabled, this can also result in a kernel panic.

Reject values that cannot be safely page-aligned before calling
PAGE_ALIGN().

Fixes: cd67e10ac699 ("zram: promote zram from staging")
Signed-off-by: Jiacheng Xu <stitch@zju.edu.cn>
---
drivers/block/zram/zram_drv.c | 3 +++
1 file changed, 3 insertions(+)

diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
index ace65c586072..2696bd3b29f6 100644
--- a/drivers/block/zram/zram_drv.c
+++ b/drivers/block/zram/zram_drv.c
@@ -2876,6 +2876,9 @@ static ssize_t disksize_store(struct device *dev, struct
device_attribute *attr,
            return -EBUSY;
      }

+     if (disksize > U64_MAX - (PAGE_SIZE - 1))
+             return -EINVAL;
+
      disksize = PAGE_ALIGN(disksize);
      if (!zram_meta_alloc(zram, disksize))
            return -ENOMEM;

Re: [PATCH] zram: reject disksize values that overflow PAGE_ALIGN

[Sergey Senozhatsky]

On (26/08/20 11:13), Jiacheng Xu wrote:
> disksize_store() parses the value written to the disksize sysfs
> attribute with memparse() and then aligns it with PAGE_ALIGN().
> 
> For values in the last PAGE_SIZE - 1 bytes of the u64 range, the
> addition performed by PAGE_ALIGN() wraps around.  For example,
> U64_MAX - 3 is aligned to zero.  zram_meta_alloc() then calls
> vzalloc(0), which triggers a warning in __vmalloc_node_range().
> 
> With panic_on_warn enabled, this can also result in a kernel panic.
> 
> Reject values that cannot be safely page-aligned before calling
> PAGE_ALIGN().
> 
> Fixes: cd67e10ac699 ("zram: promote zram from staging")
> Signed-off-by: Jiacheng Xu <stitch@zju.edu.cn>
> ---
> drivers/block/zram/zram_drv.c | 3 +++
> 1 file changed, 3 insertions(+)
> 
> diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
> index ace65c586072..2696bd3b29f6 100644
> --- a/drivers/block/zram/zram_drv.c
> +++ b/drivers/block/zram/zram_drv.c
> @@ -2876,6 +2876,9 @@ static ssize_t disksize_store(struct device *dev, struct
> device_attribute *attr,
>             return -EBUSY;
>       }
> 
> +     if (disksize > U64_MAX - (PAGE_SIZE - 1))
> +             return -EINVAL;
> +
>       disksize = PAGE_ALIGN(disksize);
>       if (!zram_meta_alloc(zram, disksize))
>             return -ENOMEM;

I think we already check disksize boundaries (you probably want to check
out linux-next):

	if (!num_pages || ((u64)num_pages << PAGE_SHIFT) != disksize)
		return -EINVAL;

Re: Re: [PATCH] zram: reject disksize values that overflow PAGE_ALIGN

[Jiacheng Xu]

Thanks for pointing this out. I checked the latest linux-next code and
confirmed that the new page-count validation rejects the reproducer
before zram_meta_alloc() calls vzalloc(0).

Best regards,
Jiacheng

> -----原始邮件-----
> 发件人: "Sergey Senozhatsky" <senozhatsky@chromium.org>
> 发送时间:2026-08-20 12:07:38 (星期四)
> 收件人: "Jiacheng Xu" <stitch@zju.edu.cn>
> 抄送: "Minchan Kim" <minchan@kernel.org>, "Sergey Senozhatsky" <senozhatsky@chromium.org>, "Jens Axboe" <axboe@kernel.dk>, linux-kernel@vger.kernel.org
> 主题: Re: [PATCH] zram: reject disksize values that overflow PAGE_ALIGN
> 
> On (26/08/20 11:13), Jiacheng Xu wrote:
> > disksize_store() parses the value written to the disksize sysfs
> > attribute with memparse() and then aligns it with PAGE_ALIGN().
> > 
> > For values in the last PAGE_SIZE - 1 bytes of the u64 range, the
> > addition performed by PAGE_ALIGN() wraps around.  For example,
> > U64_MAX - 3 is aligned to zero.  zram_meta_alloc() then calls
> > vzalloc(0), which triggers a warning in __vmalloc_node_range().
> > 
> > With panic_on_warn enabled, this can also result in a kernel panic.
> > 
> > Reject values that cannot be safely page-aligned before calling
> > PAGE_ALIGN().
> > 
> > Fixes: cd67e10ac699 ("zram: promote zram from staging")
> > Signed-off-by: Jiacheng Xu <stitch@zju.edu.cn>
> > ---
> > drivers/block/zram/zram_drv.c | 3 +++
> > 1 file changed, 3 insertions(+)
> > 
> > diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
> > index ace65c586072..2696bd3b29f6 100644
> > --- a/drivers/block/zram/zram_drv.c
> > +++ b/drivers/block/zram/zram_drv.c
> > @@ -2876,6 +2876,9 @@ static ssize_t disksize_store(struct device *dev, struct
> > device_attribute *attr,
> >             return -EBUSY;
> >       }
> > 
> > +     if (disksize > U64_MAX - (PAGE_SIZE - 1))
> > +             return -EINVAL;
> > +
> >       disksize = PAGE_ALIGN(disksize);
> >       if (!zram_meta_alloc(zram, disksize))
> >             return -ENOMEM;
> 
> I think we already check disksize boundaries (you probably want to check
> out linux-next):
> 
> 	if (!num_pages || ((u64)num_pages << PAGE_SHIFT) != disksize)
> 		return -EINVAL;