Re: Re: [PATCH] zram: reject disksize values that overflow PAGE_ALIGN

[Jiacheng Xu]

Thanks for pointing this out. I checked the latest linux-next code and
confirmed that the new page-count validation rejects the reproducer
before zram_meta_alloc() calls vzalloc(0).

Best regards,
Jiacheng

> -----原始邮件-----
> 发件人: "Sergey Senozhatsky" <senozhatsky@xxxxxxxxxxxx>
> 发送时间:2026-08-20 12:07:38 (星期四)
> 收件人: "Jiacheng Xu" <stitch@xxxxxxxxxx>
> 抄送: "Minchan Kim" <minchan@xxxxxxxxxx>, "Sergey Senozhatsky" <senozhatsky@xxxxxxxxxxxx>, "Jens Axboe" <axboe@xxxxxxxxx>, linux-kernel@xxxxxxxxxxxxxxx
> 主题: Re: [PATCH] zram: reject disksize values that overflow PAGE_ALIGN
> 
> On (26/08/20 11:13), Jiacheng Xu wrote:
> > disksize_store() parses the value written to the disksize sysfs
> > attribute with memparse() and then aligns it with PAGE_ALIGN().
> > 
> > For values in the last PAGE_SIZE - 1 bytes of the u64 range, the
> > addition performed by PAGE_ALIGN() wraps around.  For example,
> > U64_MAX - 3 is aligned to zero.  zram_meta_alloc() then calls
> > vzalloc(0), which triggers a warning in __vmalloc_node_range().
> > 
> > With panic_on_warn enabled, this can also result in a kernel panic.
> > 
> > Reject values that cannot be safely page-aligned before calling
> > PAGE_ALIGN().
> > 
> > Fixes: cd67e10ac699 ("zram: promote zram from staging")
> > Signed-off-by: Jiacheng Xu <stitch@xxxxxxxxxx>
> > ---
> > drivers/block/zram/zram_drv.c | 3 +++
> > 1 file changed, 3 insertions(+)
> > 
> > diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
> > index ace65c586072..2696bd3b29f6 100644
> > --- a/drivers/block/zram/zram_drv.c
> > +++ b/drivers/block/zram/zram_drv.c
> > @@ -2876,6 +2876,9 @@ static ssize_t disksize_store(struct device *dev, struct
> > device_attribute *attr,
> >             return -EBUSY;
> >       }
> > 
> > +     if (disksize > U64_MAX - (PAGE_SIZE - 1))
> > +             return -EINVAL;
> > +
> >       disksize = PAGE_ALIGN(disksize);
> >       if (!zram_meta_alloc(zram, disksize))
> >             return -ENOMEM;
> 
> I think we already check disksize boundaries (you probably want to check
> out linux-next):
> 
> 	if (!num_pages || ((u64)num_pages << PAGE_SHIFT) != disksize)
> 		return -EINVAL;