blkdev_pr_read_keys() takes num_keys from userspace and uses it to calculate the allocation size for keys_info via struct_size(). While there is a check for SIZE_MAX (integer overflow), there is no upper bound validation on the allocation size itself. A malicious or buggy userspace can pass a large num_keys value that doesn't trigger overflow but still results in an excessive allocation attempt, causing a warning in the page allocator when the order exceeds MAX_PAGE_ORDER. Fix this by checking that keys_info_len does not exceed KMALLOC_MAX_SIZE before attempting the allocation. Fixes: 22a1ffea5f80 ("block: add IOC_PR_READ_KEYS ioctl") Reported-by: syzbot+660d079d90f8a1baf54d@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=660d079d90f8a1baf54d Signed-off-by: Deepanshu Kartikey --- block/ioctl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/block/ioctl.c b/block/ioctl.c index 61feed686418..3e9e4257569f 100644 --- a/block/ioctl.c +++ b/block/ioctl.c @@ -443,7 +443,7 @@ static int blkdev_pr_read_keys(struct block_device *bdev, blk_mode_t mode, return -EFAULT; keys_info_len = struct_size(keys_info, keys, read_keys.num_keys); - if (keys_info_len == SIZE_MAX) + if (keys_info_len == SIZE_MAX || keys_info_len > KMALLOC_MAX_SIZE) return -EINVAL; keys_info = kzalloc(keys_info_len, GFP_KERNEL); -- 2.43.0