From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1275A4C77BE; Sat, 28 Feb 2026 17:34:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772300097; cv=none; b=X/JdPryEgJEFmsE9Tdps9HOoyScEswzHISBzuKL5v14i7FUuLcZHClhNoDor4xPMK50nPhTcwx1zgfyl3BJG1YhV9J8G/6wAbrh91l1nYoq6ZR8mJAC884wWfKhgQjcgRTyJv5AceAaaXK25/iOnZLbF1FqvM3H6H+74nalXKxw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772300097; c=relaxed/simple; bh=hqFVOjlF5+ZO2pilwS5gg2mQkEKBO5ayny0CHgbb+js=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=U3divR2PaL7yrW5sc6i2PgAd9JO/LAjLvLOPBut8Z0WsiLRXlCyAYLm9GW5Hiow9iFN1KvJCjV6Qlug3A/5v5N3n+z64s5VuHWSkJ8jQel3tqpsYyFoyyDJIZ2/CHZzGqR00Z5z5joReV2I8ZKilb7zQd2Z9Tcpxjhjp9BAuBjs= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=NgYapZDR; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="NgYapZDR" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4383CC19423; Sat, 28 Feb 2026 17:34:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1772300096; bh=hqFVOjlF5+ZO2pilwS5gg2mQkEKBO5ayny0CHgbb+js=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=NgYapZDRUtiCOZt2p1TmMiGGviXg7kIQ1Qs6FsJ1PBJSgJBLLfgrX8JsNiYBd0lOW bHo/+pLSssyVtGJGiVMZnAoeNsGIpMl6NNPfHDd4JFbD56Ov1JJ7xtJTHbjH6MradI w+HjzvJS1U57fYBceEJoX4BerJn+1C1YFekc3quiCJf3b4Npo/+z6WlOumelnc4Oii fdAQkJYDlR8l/xQZzPlE3iJgFYS14ljujqiL99NU7kqVwSaXhThjCOAbZFAKZNOyo+ 1lqoJGenMBXiOaAqROkfG+A2lBaegTOHRpLB8IQGhxZ+JR4zLe4LorXidtG0m55OtN ALs5ZQm46fWeg== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Ruipeng Qi , Kees Cook , Sasha Levin Subject: [PATCH 6.19 112/844] pstore: ram_core: fix incorrect success return when vmap() fails Date: Sat, 28 Feb 2026 12:20:25 -0500 Message-ID: <20260228173244.1509663-113-sashal@kernel.org> X-Mailer: git-send-email 2.51.0 In-Reply-To: <20260228173244.1509663-1-sashal@kernel.org> References: <20260228173244.1509663-1-sashal@kernel.org> Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit From: Ruipeng Qi [ Upstream commit 05363abc7625cf18c96e67f50673cd07f11da5e9 ] In persistent_ram_vmap(), vmap() may return NULL on failure. If offset is non-zero, adding offset_in_page(start) causes the function to return a non-NULL pointer even though the mapping failed. persistent_ram_buffer_map() therefore incorrectly returns success. Subsequent access to prz->buffer may dereference an invalid address and cause crashes. Add proper NULL checking for vmap() failures. Signed-off-by: Ruipeng Qi Link: https://patch.msgid.link/20260203020358.3315299-1-ruipengqi3@gmail.com Signed-off-by: Kees Cook Signed-off-by: Sasha Levin --- fs/pstore/ram_core.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/fs/pstore/ram_core.c b/fs/pstore/ram_core.c index c9eaacdec37e4..7b6d6378a3b87 100644 --- a/fs/pstore/ram_core.c +++ b/fs/pstore/ram_core.c @@ -457,6 +457,13 @@ static void *persistent_ram_vmap(phys_addr_t start, size_t size, vaddr = vmap(pages, page_count, VM_MAP | VM_IOREMAP, prot); kfree(pages); + /* + * vmap() may fail and return NULL. Do not add the offset in this + * case, otherwise a NULL mapping would appear successful. + */ + if (!vaddr) + return NULL; + /* * Since vmap() uses page granularity, we must add the offset * into the page here, to get the byte granularity address -- 2.51.0