Since the value of bd_wb_limit is an unsigned number, when the page size is larger than 4 KB, it may cause an out-of-bounds situation. This patch fixes the issue by limiting bd_wb_limit to be an integer multiple of PAGE_SIZE / 4096. Fixes: 1d69a3f8ae77e ("zram: idle writeback fixes and cleanup") Signed-off-by: Yuwen Chen --- Changes in v2: - Rebase the patch to adapt to the latest version. drivers/block/zram/zram_drv.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c index 8a13729..5780604 100644 --- a/drivers/block/zram/zram_drv.c +++ b/drivers/block/zram/zram_drv.c @@ -579,6 +579,7 @@ static ssize_t writeback_limit_store(struct device *dev, if (kstrtoull(buf, 10, &val)) return ret; + val = val & (~((1UL << (PAGE_SHIFT - 12)) - 1)); down_write(&zram->init_lock); zram->bd_wb_limit = val; up_write(&zram->init_lock); -- 2.34.1