Two bugs in the ramoops error paths, found by review and confirmed with
test-only reproducers against an unfixed kernel:
- ramoops_init_prz() stores persistent_ram_new()'s ERR_PTR in the zone
pointer and returns without clearing it; the probe error path then
passes it to persistent_ram_free(), which dereferences it and oopses.
- persistent_ram_buffer_map() computes buffer_size = size -
sizeof(struct persistent_ram_buffer) with no lower bound, so a zone no
larger than the header underflows buffer_size to a huge value and
defeats the bounds checks in the write paths.
The second patch adds a new failure return from persistent_ram_new() for
undersized zones, which is exactly the error path that exposes the first
bug: a tiny zone now leaves an ERR_PTR behind on cleanup. Applied
without the first patch, it turns the memory-corruption bug into a
probe-time panic on the same input, so the ERR_PTR fix is sent first.
Andrea Parri (2):
pstore: don't leave an ERR_PTR in the ramoops zone pointer
pstore: reject persistent RAM zones too small for the buffer header
fs/pstore/ram.c | 1 +
fs/pstore/ram_core.c | 6 ++++++
2 files changed, 7 insertions(+)
--
2.53.0