[PATCH 0/2] pstore: fix two ramoops error-path bugs

[Andrea Parri]

Two bugs in the ramoops error paths, found by review and confirmed with
test-only reproducers against an unfixed kernel:

 - ramoops_init_prz() stores persistent_ram_new()'s ERR_PTR in the zone
   pointer and returns without clearing it; the probe error path then
   passes it to persistent_ram_free(), which dereferences it and oopses.

 - persistent_ram_buffer_map() computes buffer_size = size -
   sizeof(struct persistent_ram_buffer) with no lower bound, so a zone no
   larger than the header underflows buffer_size to a huge value and
   defeats the bounds checks in the write paths.

The second patch adds a new failure return from persistent_ram_new() for
undersized zones, which is exactly the error path that exposes the first
bug: a tiny zone now leaves an ERR_PTR behind on cleanup.  Applied
without the first patch, it turns the memory-corruption bug into a
probe-time panic on the same input, so the ERR_PTR fix is sent first.

Andrea Parri (2):
  pstore: don't leave an ERR_PTR in the ramoops zone pointer
  pstore: reject persistent RAM zones too small for the buffer header

 fs/pstore/ram.c      | 1 +
 fs/pstore/ram_core.c | 6 ++++++
 2 files changed, 7 insertions(+)

-- 
2.53.0