From 1b30df8662ac85a6759be4332f3bec7e3cb28efc Mon Sep 17 00:00:00 2001 From: Andrea Parri Date: Mon, 21 Sep 2026 22:23:16 +0200 Subject: [PATCH] pstore: reject persistent RAM zones too small for the buffer header persistent_ram_buffer_map() computes prz->buffer_size = size - sizeof(struct persistent_ram_buffer); without checking that size is large enough to hold the header. A ramoops zone configured with a tiny size (e.g. ramoops.pmsg_size=1) underflows buffer_size to a huge value, which defeats every bounds check in persistent_ram_write() and persistent_ram_write_user(); a write to /dev/pmsg0 then copies user data far past the end of the zone and corrupts kernel memory. Reject zones that are not larger than the buffer header. Fixes: 404a6043385de ("staging: android: persistent_ram: handle reserving and mapping memory") Assisted-by: LLM Signed-off-by: Andrea Parri Link: https://patch.msgid.link/20260921202317.70595-3-parri.andrea@gmail.com Signed-off-by: Kees Cook --- fs/pstore/ram_core.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/fs/pstore/ram_core.c b/fs/pstore/ram_core.c index b4ec8009b8dc..ae941777037b 100644 --- a/fs/pstore/ram_core.c +++ b/fs/pstore/ram_core.c @@ -505,6 +505,12 @@ static int persistent_ram_buffer_map(phys_addr_t start, phys_addr_t size, prz->paddr = start; prz->size = size; + if (size <= sizeof(struct persistent_ram_buffer)) { + pr_err("%s: persistent ram zone too small (%#llx bytes)\n", + prz->label, (unsigned long long)size); + return -EINVAL; + } + if (pfn_valid(start >> PAGE_SHIFT)) prz->vaddr = persistent_ram_vmap(start, size, memtype); else