From nobody Mon Sep 28 16:22:26 2026 Received: from azure-sdnproxy.icoremail.net (azure-sdnproxy.icoremail.net [40.65.178.148]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 0A98F345EC3 for ; Thu, 20 Aug 2026 03:13:42 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=40.65.178.148 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787195628; cv=none; b=Q5/HBgM1L8i1tygH+Hxvv4pGB6xdMkeoHg/TtM4z81hE0s513x2b6eqIGHe8bVKPDToIF0DhRHo9JXonDbT+mag8HInii7D6ypGQTZ3C8wUrIm041+9iqWNMN0tsZAAaiMTurn4fNWMKE7VWAAC/D04gxlp1V0kXdFJ3zJrX9jQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787195628; c=relaxed/simple; bh=3O6SMVf0Ut3Sv8OI6LlWnrlINoDvVY88vxGXMMc9hSI=; h=Date:From:To:Cc:Subject:Content-Type:MIME-Version:Message-ID; b=k324h9NgLmtSWjYGw0Q5qWEG72hRBfLYXcAd4i6qDK+03X64hiBWB/YJpVCaflrXKksEH9SBScrjqp/5UebAYcx7Dv+0pxfgYLHAt765HqpwuoLnexkJNmtIveeDjzaUkiKC3jePZCZJi0czsIhl5Gl2bYJzbWVh3vt3nfi14XI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=zju.edu.cn; spf=pass smtp.mailfrom=zju.edu.cn; arc=none smtp.client-ip=40.65.178.148 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=zju.edu.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=zju.edu.cn Received: from zju.edu.cn (unknown [10.190.161.59]) by mtasvr (Coremail) with SMTP id _____wD3_y_jcIZqbqarAA--.1131S3; Thu, 20 Aug 2026 11:13:40 +0800 (CST) Received: from stitch$zju.edu.cn ( [10.190.161.59] ) by ajax-webmail-mail-app2 (Coremail) ; Thu, 20 Aug 2026 11:13:39 +0800 (GMT+08:00) Date: Thu, 20 Aug 2026 11:13:39 +0800 (GMT+08:00) X-CM-HeaderCharset: UTF-8 From: "Jiacheng Xu" To: "Minchan Kim" Cc: "Sergey Senozhatsky" , "Jens Axboe" , linux-kernel@vger.kernel.org Subject: [PATCH] zram: reject disksize values that overflow PAGE_ALIGN X-Priority: 3 X-Mailer: Coremail Webmail Server Version 2025.3-cmXT6 build 20260617(6f868824) Copyright (c) 2002-2026 www.mailtech.cn zju.edu.cn Content-Transfer-Encoding: quoted-printable Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Message-ID: <1760e5f1.15b52.1a01d28f800.Coremail.stitch@zju.edu.cn> X-Coremail-Locale: zh_CN X-CM-TRANSID: zC_KCgAHu9LjcIZq6rcCBA--.29626W X-CM-SenderInfo: qtrxiiaqttimo62m3hxhgxhubq/1tbiAwYIC2qFDZYO3QADsi X-CM-DELIVERINFO: =?B?hkaiVAXKKxbFmtjJiESix3B1w3tMoM3snk/k5SVzZVydjEqe1eefKHnLf95EnB4iem egW8xaWla3YoONmDfjvRmE1jUwzkwYRcto53APmyZY0wd9wtQU4l2t+bn1FK11S4fs01HS l4Lc8fzkX4LX+3BJlbN3p5noE4VDw4T1xb/hsI5YpZHEank6NUPaEKaAJmWRXg== X-Coremail-Antispam: 1Uk129KBj93XoWruF15Ww45Zr1kGF1fGr48AFc_yoW8Jry7pF WUGry5CryjqF1UWa18Zw1SgryYk3ZrA34Igas5C3yF9rWrGF97A34fJ34jgFy7Zr1kCFWS qrn8JF4rWFW8urXCm3ZEXasCq-sJn29KB7ZKAUJUUUUU529EdanIXcx71UUUUU7KY7ZEXa sCq-sGcSsGvfJ3Ic02F40EFcxC0VAKzVAqx4xG6I80ebIjqfuFe4nvWSU5nxnvy29KBjDU 0xBIdaVrnRJUUUPGb4IE77IF4wAFF20E14v26r1j6r4UM7CY07I20VC2zVCF04k26cxKx2 IYs7xG6rWj6s0DM7CIcVAFz4kK6r1j6r18M28lY4IEw2IIxxk0rwA2F7IY1VAKz4vEj48v e4kI8wA2z4x0Y4vE2Ix0cI8IcVAFwI0_tr0E3s1l84ACjcxK6xIIjxv20xvEc7CjxVAFwI 0_Gr1j6F4UJwA2z4x0Y4vEx4A2jsIE14v26rxl6s0DM28EF7xvwVC2z280aVCY1x0267AK xVW0oVCq3wAS0I0E0xvYzxvE52x082IY62kv0487Mc804VCY07AIYIkI8VC2zVCFFI0UMc 02F40EFcxC0VAKzVAqx4xG6I80ewAv7VC0I7IYx2IY67AKxVWUJVWUGwAv7VC2z280aVAF wI0_Jr0_Gr1lOx8S6xCaFVCjc4AY6r1j6r4UM4x0Y48IcxkI7VAKI48JM4x0Y48IcxkI7V AKI48G6xCjnVAKz4kxM4xvF2IEb7IF0Fy264kE64k0F24lFcxC0VAYjxAxZF0Ex2IqxwCF 04k20xvY0x0EwIxGrwCFx2IqxVCFs4IE7xkEbVWUJVW8JwC20s026c02F40E14v26r1j6r 18MI8I3I0E7480Y4vE14v26r106r1rMI8E67AF67kF1VAFwI0_JF0_Jw1lIxkGc2Ij64vI r41lIxAIcVC0I7IYx2IY67AKxVWUJVWUCwCI42IY6xIIjxv20xvEc7CjxVAFwI0_Jr0_Gr 1lIxAIcVCF04k26cxKx2IYs7xG6r1j6r1xMIIF0xvEx4A2jsIE14v26r1j6r4UMIIF0xvE x4A2jsIEc7CjxVAFwI0_Jr0_Gr1l6VACY4xI67k04243AbIYCTnIWIevJa73UjIFyTuYvj xU2_HjUUUUU Content-Type: text/plain; charset="utf-8" disksize_store() parses the value written to the disksize sysfs attribute with memparse() and then aligns it with PAGE_ALIGN(). For values in the last PAGE_SIZE - 1 bytes of the u64 range, the addition performed by PAGE_ALIGN() wraps around. For example, U64_MAX - 3 is aligned to zero. zram_meta_alloc() then calls vzalloc(0), which triggers a warning in __vmalloc_node_range(). With panic_on_warn enabled, this can also result in a kernel panic. Reject values that cannot be safely page-aligned before calling PAGE_ALIGN(). Fixes: cd67e10ac699 ("zram: promote zram from staging") Signed-off-by: Jiacheng Xu --- drivers/block/zram/zram_drv.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c index ace65c586072..2696bd3b29f6 100644 --- a/drivers/block/zram/zram_drv.c +++ b/drivers/block/zram/zram_drv.c @@ -2876,6 +2876,9 @@ static ssize_t disksize_store(struct device *dev, str= uct device_attribute *attr, return -EBUSY; } + if (disksize > U64_MAX - (PAGE_SIZE - 1)) + return -EINVAL; + disksize =3D PAGE_ALIGN(disksize); if (!zram_meta_alloc(zram, disksize)) return -ENOMEM;