[PATCH] zram: reject disksize values that overflow PAGE_ALIGN

[PATCH] zram: reject disksize values that overflow PAGE_ALIGN

[Jiacheng Xu]

disksize_store() parses the value written to the disksize sysfs
attribute with memparse() and then aligns it with PAGE_ALIGN().

For values in the last PAGE_SIZE - 1 bytes of the u64 range, the
addition performed by PAGE_ALIGN() wraps around.  For example,
U64_MAX - 3 is aligned to zero.  zram_meta_alloc() then calls
vzalloc(0), which triggers a warning in __vmalloc_node_range().

With panic_on_warn enabled, this can also result in a kernel panic.

Reject values that cannot be safely page-aligned before calling
PAGE_ALIGN().

Fixes: cd67e10ac699 ("zram: promote zram from staging")
Signed-off-by: Jiacheng Xu <stitch@zju.edu.cn>
---
drivers/block/zram/zram_drv.c | 3 +++
1 file changed, 3 insertions(+)

diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
index ace65c586072..2696bd3b29f6 100644
--- a/drivers/block/zram/zram_drv.c
+++ b/drivers/block/zram/zram_drv.c
@@ -2876,6 +2876,9 @@ static ssize_t disksize_store(struct device *dev, struct
device_attribute *attr,
            return -EBUSY;
      }

+     if (disksize > U64_MAX - (PAGE_SIZE - 1))
+             return -EINVAL;
+
      disksize = PAGE_ALIGN(disksize);
      if (!zram_meta_alloc(zram, disksize))
            return -ENOMEM;

Re: [PATCH] zram: reject disksize values that overflow PAGE_ALIGN

[Sergey Senozhatsky]

On (26/08/20 11:13), Jiacheng Xu wrote:
> disksize_store() parses the value written to the disksize sysfs
> attribute with memparse() and then aligns it with PAGE_ALIGN().
> 
> For values in the last PAGE_SIZE - 1 bytes of the u64 range, the
> addition performed by PAGE_ALIGN() wraps around.  For example,
> U64_MAX - 3 is aligned to zero.  zram_meta_alloc() then calls
> vzalloc(0), which triggers a warning in __vmalloc_node_range().
> 
> With panic_on_warn enabled, this can also result in a kernel panic.
> 
> Reject values that cannot be safely page-aligned before calling
> PAGE_ALIGN().
> 
> Fixes: cd67e10ac699 ("zram: promote zram from staging")
> Signed-off-by: Jiacheng Xu <stitch@zju.edu.cn>
> ---
> drivers/block/zram/zram_drv.c | 3 +++
> 1 file changed, 3 insertions(+)
> 
> diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
> index ace65c586072..2696bd3b29f6 100644
> --- a/drivers/block/zram/zram_drv.c
> +++ b/drivers/block/zram/zram_drv.c
> @@ -2876,6 +2876,9 @@ static ssize_t disksize_store(struct device *dev, struct
> device_attribute *attr,
>             return -EBUSY;
>       }
> 
> +     if (disksize > U64_MAX - (PAGE_SIZE - 1))
> +             return -EINVAL;
> +
>       disksize = PAGE_ALIGN(disksize);
>       if (!zram_meta_alloc(zram, disksize))
>             return -ENOMEM;

I think we already check disksize boundaries (you probably want to check
out linux-next):

	if (!num_pages || ((u64)num_pages << PAGE_SHIFT) != disksize)
		return -EINVAL;