Re: [PATCH] zsmalloc: don't underflow size calculation in zs_obj_write()

[Igor Belousov <igor.b@beldev.am>]

On 2025-05-04 15:00, Sergey Senozhatsky wrote:
> Do not mix class->size and object size during offsets/sizes
> calculation in zs_obj_write().  Size classes can merge into
> clusters, based on objects-per-zspage and pages-per-zspage
> characteristics, so some size classes can store objects
> smaller than class->size.  This becomes problematic when
> object size is much smaller than class->size - we can determine
> that object spans two physical pages, because we use a larger
> class->size for this, while the actual object is much smaller
> and fits one physical page, so there is nothing to write to
> the second page and memcpy() size calculation underflows.
> 
> We always know the exact size in bytes of the object
> that we are about to write (store), so use it instead of
> class->size.
> 
> Reported-by: Igor Belousov <igor.b@beldev.am>
> Cc: <stable@vger.kernel.org>
> Signed-off-by: Sergey Senozhatsky <senozhatsky@chromium.org>

Tested-by: Igor Belousov <igor.b@beldev.am>

> ---
>  mm/zsmalloc.c | 8 ++++----
>  1 file changed, 4 insertions(+), 4 deletions(-)
> 
> diff --git a/mm/zsmalloc.c b/mm/zsmalloc.c
> index 70406ac94bbd..999b513c7fdf 100644
> --- a/mm/zsmalloc.c
> +++ b/mm/zsmalloc.c
> @@ -1233,19 +1233,19 @@ void zs_obj_write(struct zs_pool *pool, 
> unsigned long handle,
>  	class = zspage_class(pool, zspage);
>  	off = offset_in_page(class->size * obj_idx);
> 
> -	if (off + class->size <= PAGE_SIZE) {
> +	if (!ZsHugePage(zspage))
> +		off += ZS_HANDLE_SIZE;
> +
> +	if (off + mem_len <= PAGE_SIZE) {
>  		/* this object is contained entirely within a page */
>  		void *dst = kmap_local_zpdesc(zpdesc);
> 
> -		if (!ZsHugePage(zspage))
> -			off += ZS_HANDLE_SIZE;
>  		memcpy(dst + off, handle_mem, mem_len);
>  		kunmap_local(dst);
>  	} else {
>  		/* this object spans two pages */
>  		size_t sizes[2];
> 
> -		off += ZS_HANDLE_SIZE;
>  		sizes[0] = PAGE_SIZE - off;
>  		sizes[1] = mem_len - sizes[0];