[PATCH] incfs: validate rlog_pages mount option against MAX_ORDER_NR_PAGES

[PATCH] incfs: validate rlog_pages mount option against MAX_ORDER_NR_PAGES

[Tamil Mathi]

The rlog_pages mount option is parsed from user-supplied mount data and
used directly to compute the read log ring buffer size:

  new_buffer_size = PAGE_SIZE * options->read_log_pages;
  new_buffer = kzalloc(new_buffer_size, GFP_NOFS);

kzalloc() for a contiguous allocation larger than MAX_ORDER_NR_PAGES
pages triggers WARN_ON(order > MAX_ORDER) in __alloc_pages_noprof().
A user can pass rlog_pages=22472 (~88 MB) to reliably trigger this
WARNING during mount.

Fix this by rejecting rlog_pages values that exceed MAX_ORDER_NR_PAGES
at parse time, returning -EINVAL for out-of-range values.

Reported-by: syzbot+75ff1aecfbeeefb78736@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=75ff1aecfbeeefb78736
Signed-off-by: Tamil Mathi <9tamilmathi@gmail.com>
---
 fs/incfs/vfs.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/incfs/vfs.c b/fs/incfs/vfs.c
index b45533b..4eaf890 100644
--- a/fs/incfs/vfs.c
+++ b/fs/incfs/vfs.c
@@ -270,6 +270,8 @@ static int parse_options(struct mount_options *opts, char *str)
 		case Opt_rlog_pages:
 			if (match_int(&args[0], &value))
 				return -EINVAL;
+			if (value < 0 || value > MAX_ORDER_NR_PAGES)
+				return -EINVAL;
 			opts->read_log_pages = value;
 			break;
 		case Opt_rlog_wakeup_cnt:
-- 
2.39.5 (Apple Git-154)