[PATCH] zram: reject zero or overflowed disksize in disksize_store

[PATCH] zram: reject zero or overflowed disksize in disksize_store

[Rohinthan]

When userspace writes a value close to U64_MAX (such as (u64)-1) to the
sysfs attribute /sys/block/zram<id>/disksize, disksize_store() parses it
with memparse() and then calls:

    disksize = PAGE_ALIGN(disksize);

Because adding PAGE_SIZE - 1 to values in the range
[U64_MAX - PAGE_SIZE + 2, U64_MAX] causes an integer overflow wrapping
to 0, disksize becomes 0. disksize_store() then passes 0 to
zram_meta_alloc(), which computes num_pages = 0 and calls vzalloc(0).

In mm/vmalloc.c, __vmalloc_node_range_noprof() checks
`if (WARN_ON_ONCE(!size))` and triggers a kernel warning:

    WARNING: mm/vmalloc.c:4038 at __vmalloc_node_range_noprof
    Call trace:
     __vmalloc_node_range_noprof
     vzalloc_noprof
     disksize_store
     dev_attr_store
     sysfs_kf_write

Fix this by checking if disksize wrapped to 0 after PAGE_ALIGN(disksize)
and returning -EINVAL. Also add a defensive check in zram_meta_alloc()
to return false if disksize is 0, avoiding vzalloc(0) under any
circumstance.

Fixes: cd67e10ac699 ("zram: promote zram from staging")
Reported-by: syzbot+fb23651a7efbea8868ed@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=fb23651a7efbea8868ed
Signed-off-by: Rohinthan <rokinthanp03@gmail.com>
---
 drivers/block/zram/zram_drv.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
index 6cb44e2..fdd13df 100644
--- a/drivers/block/zram/zram_drv.c
+++ b/drivers/block/zram/zram_drv.c
@@ -1989,6 +1989,9 @@ static bool zram_meta_alloc(struct zram *zram, u64 disksize)
 {
 	size_t num_pages;
 
+	if (!disksize)
+		return false;
+
 	num_pages = disksize >> PAGE_SHIFT;
 	zram->table = vzalloc(array_size(num_pages, sizeof(*zram->table)));
 	if (!zram->table)
@@ -2878,6 +2881,9 @@ static ssize_t disksize_store(struct device *dev, struct device_attribute *attr,
 	}
 
 	disksize = PAGE_ALIGN(disksize);
+	if (!disksize)
+		return -EINVAL;
+
 	if (!zram_meta_alloc(zram, disksize))
 		return -ENOMEM;
 
-- 
2.53.0

[PATCH] zram: reject zero or overflowed disksize in disksize_store

[Rokinthan p]

[-- Attachment #1: Type: text/plain, Size: 1 bytes --]



[-- Attachment #2: 0001-zram-reject-zero-or-overflowed-disksize-in-disksize_.patch --]
[-- Type: text/x-patch, Size: 2251 bytes --]

From 3da88eb06cab31ba35cc91bcf6583ae155017210 Mon Sep 17 00:00:00 2001
From: Rohinthan <rokinthanp03@gmail.com>
Date: Tue, 22 Sep 2026 16:26:57 +0530
Subject: [PATCH] zram: reject zero or overflowed disksize in disksize_store

When userspace writes a value close to U64_MAX (such as (u64)-1) to the
sysfs attribute /sys/block/zram<id>/disksize, disksize_store() parses it
with memparse() and then calls:

    disksize = PAGE_ALIGN(disksize);

Because adding PAGE_SIZE - 1 to values in the range
[U64_MAX - PAGE_SIZE + 2, U64_MAX] causes an integer overflow wrapping
to 0, disksize becomes 0. disksize_store() then passes 0 to
zram_meta_alloc(), which computes num_pages = 0 and calls vzalloc(0).

In mm/vmalloc.c, __vmalloc_node_range_noprof() checks
`if (WARN_ON_ONCE(!size))` and triggers a kernel warning:

    WARNING: mm/vmalloc.c:4038 at __vmalloc_node_range_noprof
    Call trace:
     __vmalloc_node_range_noprof
     vzalloc_noprof
     disksize_store
     dev_attr_store
     sysfs_kf_write

Fix this by checking if disksize wrapped to 0 after PAGE_ALIGN(disksize)
and returning -EINVAL. Also add a defensive check in zram_meta_alloc()
to return false if disksize is 0, avoiding vzalloc(0) under any
circumstance.

Fixes: cd67e10ac699 ("zram: promote zram from staging")
Reported-by: syzbot+fb23651a7efbea8868ed@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=fb23651a7efbea8868ed
Signed-off-by: Rohinthan <rokinthanp03@gmail.com>
---
 drivers/block/zram/zram_drv.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
index 6cb44e2..fdd13df 100644
--- a/drivers/block/zram/zram_drv.c
+++ b/drivers/block/zram/zram_drv.c
@@ -1989,6 +1989,9 @@ static bool zram_meta_alloc(struct zram *zram, u64 disksize)
 {
 	size_t num_pages;
 
+	if (!disksize)
+		return false;
+
 	num_pages = disksize >> PAGE_SHIFT;
 	zram->table = vzalloc(array_size(num_pages, sizeof(*zram->table)));
 	if (!zram->table)
@@ -2878,6 +2881,9 @@ static ssize_t disksize_store(struct device *dev, struct device_attribute *attr,
 	}
 
 	disksize = PAGE_ALIGN(disksize);
+	if (!disksize)
+		return -EINVAL;
+
 	if (!zram_meta_alloc(zram, disksize))
 		return -ENOMEM;
 
-- 
2.53.0