From: Eugen Hristev Date: Fri, 10 Jan 2025 12:57:14 +0000 (+0200) Subject: pstore/zone: avoid dereferencing zero sized ptr after init zones X-Git-Tag: v6.14-rc1~205^2 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=067cdf020329a07dd8ee1574c3086998343b1b2b;p=thirdparty%2Flinux.git pstore/zone: avoid dereferencing zero sized ptr after init zones In psz_init_zones, if the requested area has a total_size less than record_size, kcalloc will be called with c == 0 and will return ZERO_SIZE_PTR. Further, this will lead to an oops. With this patch, in this scenario, it will look like this : [ 6.865545] pstore_zone: total size : 28672 Bytes [ 6.865547] pstore_zone: kmsg size : 65536 Bytes [ 6.865549] pstore_zone: pmsg size : 0 Bytes [ 6.865551] pstore_zone: console size : 0 Bytes [ 6.865553] pstore_zone: ftrace size : 0 Bytes [ 6.872095] pstore_zone: zone dmesg total_size too small [ 6.878234] pstore_zone: alloc zones failed Signed-off-by: Eugen Hristev Link: https://lore.kernel.org/r/20250110125714.2594719-1-eugen.hristev@linaro.org Signed-off-by: Kees Cook --- diff --git a/fs/pstore/zone.c b/fs/pstore/zone.c index 694db616663f0..ceb5639a06296 100644 --- a/fs/pstore/zone.c +++ b/fs/pstore/zone.c @@ -1212,6 +1212,11 @@ static struct pstore_zone **psz_init_zones(enum pstore_type_id type, } c = total_size / record_size; + if (unlikely(!c)) { + pr_err("zone %s total_size too small\n", name); + return ERR_PTR(-EINVAL); + } + zones = kcalloc(c, sizeof(*zones), GFP_KERNEL); if (!zones) { pr_err("allocate for zones %s failed\n", name);