[PATCH 1/1] zram: reject disksizes that exceed slot index range

[PATCH 1/1] zram: reject disksizes that exceed slot index range

[Longlong Xia]

From: Longlong Xia <xialonglong@kylinos.cn>

zram uses u32 slot indexes, while disksize_store() accepts a u64
size. On 32-bit systems, a disksize larger than U32_MAX pages is
truncated when zram_meta_alloc() assigns the page count to size_t.
array_size() then sees only the truncated count, so a small table can
be allocated while the original capacity is published. Valid I/O
within that capacity can subsequently access beyond zram->table.

The same oversized capacity also lets full-device scanners compare a
u32 index with an upper bound larger than U32_MAX, so the index can
wrap instead of terminating.

Reject disksizes larger than U32_MAX pages before aligning and
allocating the table. This keeps the table size, published capacity and
slot index range consistent.

Fixes: 33863c21e69e ("Staging: zram: Replace ioctls with sysfs interface")
Cc: <stable@vger.kernel.org>
Assisted-by: Codex:gpt-5.6-sol
Signed-off-by: Longlong Xia <xialonglong@kylinos.cn>
---
 drivers/block/zram/zram_drv.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
index ace65c586072..2728a8a826d4 100644
--- a/drivers/block/zram/zram_drv.c
+++ b/drivers/block/zram/zram_drv.c
@@ -2876,6 +2876,9 @@ static ssize_t disksize_store(struct device *dev, struct device_attribute *attr,
 		return -EBUSY;
 	}
 
+	if (disksize > (u64)U32_MAX << PAGE_SHIFT)
+		return -EINVAL;
+
 	disksize = PAGE_ALIGN(disksize);
 	if (!zram_meta_alloc(zram, disksize))
 		return -ENOMEM;
-- 
2.43.0

Re: [PATCH 1/1] zram: reject disksizes that exceed slot index range

[Sergey Senozhatsky]

On (26/08/04 22:38), Longlong Xia wrote:
> zram uses u32 slot indexes, while disksize_store() accepts a u64
> size. On 32-bit systems, a disksize larger than U32_MAX pages is
> truncated when zram_meta_alloc() assigns the page count to size_t.
> array_size() then sees only the truncated count, so a small table can
> be allocated while the original capacity is published. Valid I/O
> within that capacity can subsequently access beyond zram->table.
> 
> The same oversized capacity also lets full-device scanners compare a
> u32 index with an upper bound larger than U32_MAX, so the index can
> wrap instead of terminating.
> 
> Reject disksizes larger than U32_MAX pages before aligning and
> allocating the table. This keeps the table size, published capacity and
> slot index range consistent.
> 
> Fixes: 33863c21e69e ("Staging: zram: Replace ioctls with sysfs interface")
> Cc: <stable@vger.kernel.org>
> Assisted-by: Codex:gpt-5.6-sol
> Signed-off-by: Longlong Xia <xialonglong@kylinos.cn>

Reviewed-by: Sergey Senozhatsky <senozhatsky@chromium.org>

Re: [PATCH 1/1] zram: reject disksizes that exceed slot index range

[Andrew Morton]

On Tue,  4 Aug 2026 22:38:32 +0800 Longlong Xia <xialonglong2025@163.com> wrote:

> From: Longlong Xia <xialonglong@kylinos.cn>
> 
> zram uses u32 slot indexes, while disksize_store() accepts a u64
> size. On 32-bit systems, a disksize larger than U32_MAX pages is
> truncated when zram_meta_alloc() assigns the page count to size_t.
> array_size() then sees only the truncated count, so a small table can
> be allocated while the original capacity is published. Valid I/O
> within that capacity can subsequently access beyond zram->table.
> 
> The same oversized capacity also lets full-device scanners compare a
> u32 index with an upper bound larger than U32_MAX, so the index can
> wrap instead of terminating.
> 
> Reject disksizes larger than U32_MAX pages before aligning and
> allocating the table. This keeps the table size, published capacity and
> slot index range consistent.

Oh.  Rejecting large devices sounds severe.  Can't we just fix the
32-bit trucation issues?

> --- a/drivers/block/zram/zram_drv.c
> +++ b/drivers/block/zram/zram_drv.c
> @@ -2876,6 +2876,9 @@ static ssize_t disksize_store(struct device *dev, struct device_attribute *attr,
>  		return -EBUSY;
>  	}
>  
> +	if (disksize > (u64)U32_MAX << PAGE_SHIFT)
> +		return -EINVAL;
> +

It would be helpful to have a comment explaining why we're doing this.


AI review appears to have found a similar issue in mark_idle(),
although it could be that your patch accidentally prevents it from
occurring:

	https://sashiko.dev/#/patchset/20260804143832.146129-1-xialonglong2025@163.com

Re: [PATCH 1/1] zram: reject disksizes that exceed slot index range

[Sergey Senozhatsky]

On (26/08/05 11:54), Andrew Morton wrote:
> > From: Longlong Xia <xialonglong@kylinos.cn>
> > 
> > zram uses u32 slot indexes, while disksize_store() accepts a u64
> > size. On 32-bit systems, a disksize larger than U32_MAX pages is
> > truncated when zram_meta_alloc() assigns the page count to size_t.
> > array_size() then sees only the truncated count, so a small table can
> > be allocated while the original capacity is published. Valid I/O
> > within that capacity can subsequently access beyond zram->table.
> > 
> > The same oversized capacity also lets full-device scanners compare a
> > u32 index with an upper bound larger than U32_MAX, so the index can
> > wrap instead of terminating.
> > 
> > Reject disksizes larger than U32_MAX pages before aligning and
> > allocating the table. This keeps the table size, published capacity and
> > slot index range consistent.
> 
> Oh.  Rejecting large devices sounds severe.  Can't we just fix the
> 32-bit trucation issues?

zram historically used u32, I never thought that anyone would want
a 16TB+ device.  But we don't really have reasons to limit it.

I can look into converting to unsigned long, Longlong is already
looking into it.