[PATCH] zram: reject disksize values that overflow PAGE_ALIGN

[Jiacheng Xu]

disksize_store() parses the value written to the disksize sysfs
attribute with memparse() and then aligns it with PAGE_ALIGN().

For values in the last PAGE_SIZE - 1 bytes of the u64 range, the
addition performed by PAGE_ALIGN() wraps around.  For example,
U64_MAX - 3 is aligned to zero.  zram_meta_alloc() then calls
vzalloc(0), which triggers a warning in __vmalloc_node_range().

With panic_on_warn enabled, this can also result in a kernel panic.

Reject values that cannot be safely page-aligned before calling
PAGE_ALIGN().

Fixes: cd67e10ac699 ("zram: promote zram from staging")
Signed-off-by: Jiacheng Xu <stitch@xxxxxxxxxx>
---
drivers/block/zram/zram_drv.c | 3 +++
1 file changed, 3 insertions(+)

diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
index ace65c586072..2696bd3b29f6 100644
--- a/drivers/block/zram/zram_drv.c
+++ b/drivers/block/zram/zram_drv.c
@@ -2876,6 +2876,9 @@ static ssize_t disksize_store(struct device *dev, struct
device_attribute *attr,
            return -EBUSY;
      }

+     if (disksize > U64_MAX - (PAGE_SIZE - 1))
+             return -EINVAL;
+
      disksize = PAGE_ALIGN(disksize);
      if (!zram_meta_alloc(zram, disksize))
            return -ENOMEM;