| Message ID | 20250110125714.2594719-1-eugen.hristev@linaro.org (mailing list archive) |
|---|---|
| State | Mainlined |
| Commit | 067cdf020329a07dd8ee1574c3086998343b1b2b |
| Headers | show |
| Series | [v2] pstore/zone: avoid dereferencing zero sized ptr after init zones | expand |
On Fri, 10 Jan 2025 14:57:14 +0200, Eugen Hristev wrote: > In psz_init_zones, if the requested area has a total_size less than > record_size, kcalloc will be called with c == 0 and will return > ZERO_SIZE_PTR. > Further, this will lead to an oops. > > With this patch, in this scenario, it will look like this : > [ 6.865545] pstore_zone: total size : 28672 Bytes > [ 6.865547] pstore_zone: kmsg size : 65536 Bytes > [ 6.865549] pstore_zone: pmsg size : 0 Bytes > [ 6.865551] pstore_zone: console size : 0 Bytes > [ 6.865553] pstore_zone: ftrace size : 0 Bytes > [ 6.872095] pstore_zone: zone dmesg total_size too small > [ 6.878234] pstore_zone: alloc zones failed > > [...] Applied to for-next/pstore, thanks! [1/1] pstore/zone: avoid dereferencing zero sized ptr after init zones https://git.kernel.org/kees/c/067cdf020329 Take care,
diff --git a/fs/pstore/zone.c b/fs/pstore/zone.c index 694db616663f..ceb5639a0629 100644 --- a/fs/pstore/zone.c +++ b/fs/pstore/zone.c @@ -1212,6 +1212,11 @@ static struct pstore_zone **psz_init_zones(enum pstore_type_id type, } c = total_size / record_size; + if (unlikely(!c)) { + pr_err("zone %s total_size too small\n", name); + return ERR_PTR(-EINVAL); + } + zones = kcalloc(c, sizeof(*zones), GFP_KERNEL); if (!zones) { pr_err("allocate for zones %s failed\n", name);
In psz_init_zones, if the requested area has a total_size less than record_size, kcalloc will be called with c == 0 and will return ZERO_SIZE_PTR. Further, this will lead to an oops. With this patch, in this scenario, it will look like this : [ 6.865545] pstore_zone: total size : 28672 Bytes [ 6.865547] pstore_zone: kmsg size : 65536 Bytes [ 6.865549] pstore_zone: pmsg size : 0 Bytes [ 6.865551] pstore_zone: console size : 0 Bytes [ 6.865553] pstore_zone: ftrace size : 0 Bytes [ 6.872095] pstore_zone: zone dmesg total_size too small [ 6.878234] pstore_zone: alloc zones failed Signed-off-by: Eugen Hristev <eugen.hristev@linaro.org> --- Changes in v2: - reworked to check for c==0 instead of ZERO_SIZE_PTR as suggested by Kees Cook fs/pstore/zone.c | 5 +++++ 1 file changed, 5 insertions(+)