[PATCH 1/1] zram: reject disksizes that exceed slot index range

[Longlong Xia]

From: Longlong Xia <xialonglong@xxxxxxxxxx>

zram uses u32 slot indexes, while disksize_store() accepts a u64
size. On 32-bit systems, a disksize larger than U32_MAX pages is
truncated when zram_meta_alloc() assigns the page count to size_t.
array_size() then sees only the truncated count, so a small table can
be allocated while the original capacity is published. Valid I/O
within that capacity can subsequently access beyond zram->table.

The same oversized capacity also lets full-device scanners compare a
u32 index with an upper bound larger than U32_MAX, so the index can
wrap instead of terminating.

Reject disksizes larger than U32_MAX pages before aligning and
allocating the table. This keeps the table size, published capacity and
slot index range consistent.

Fixes: 33863c21e69e ("Staging: zram: Replace ioctls with sysfs interface")
Cc: <stable@xxxxxxxxxxxxxxx>
Assisted-by: Codex:gpt-5.6-sol
Signed-off-by: Longlong Xia <xialonglong@xxxxxxxxxx>
---
 drivers/block/zram/zram_drv.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
index ace65c586072..2728a8a826d4 100644
--- a/drivers/block/zram/zram_drv.c
+++ b/drivers/block/zram/zram_drv.c
@@ -2876,6 +2876,9 @@ static ssize_t disksize_store(struct device *dev, struct device_attribute *attr,
 		return -EBUSY;
 	}
 
+	if (disksize > (u64)U32_MAX << PAGE_SHIFT)
+		return -EINVAL;
+
 	disksize = PAGE_ALIGN(disksize);
 	if (!zram_meta_alloc(zram, disksize))
 		return -ENOMEM;
-- 
2.43.0