linux-kernel - Coverity: zram_recompress(): OVERRUN

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date:   Thu, 10 Nov 2022 08:47:12 -0800
From:   coverity-bot <keescook@...omium.org>
To:     Sergey Senozhatsky <senozhatsky@...omium.org>
Cc:     Alexey Romanov <avromanov@...rdevices.ru>,
        linux-kernel@...r.kernel.org, Nick Terrell <terrelln@...com>,
        Minchan Kim <minchan@...nel.org>,
        Suleiman Souhlal <suleiman@...gle.com>,
        Nitin Gupta <ngupta@...are.org>, Jens Axboe <axboe@...nel.dk>,
        Nhat Pham <nphamcs@...il.com>,
        Andrew Morton <akpm@...ux-foundation.org>,
        linux-block@...r.kernel.org,
        "Gustavo A. R. Silva" <gustavo@...eddedor.com>,
        linux-next@...r.kernel.org, linux-hardening@...r.kernel.org
Subject: Coverity: zram_recompress(): OVERRUN

Hello!

This is an experimental semi-automated report about issues detected by
Coverity from a scan of next-20221110 as part of the linux-next scan project:
https://scan.coverity.com/projects/linux-next-weekly-scan

You're getting this email because you were associated with the identified
lines of code (noted below) that were touched by commits:

  Wed Nov 9 20:33:48 2022 -0800
    03e6c729aa64 ("zram: introduce recompress sysfs knob")

Coverity reported the following:

*** CID 1527270:    (OVERRUN)
drivers/block/zram/zram_drv.c:1727 in zram_recompress()
1721     		zstrm = zcomp_stream_get(zram->comps[prio]);
1722     		src = kmap_atomic(page);
1723     		ret = zcomp_compress(zstrm, src, &comp_len_new);
1724     		kunmap_atomic(src);
1725
1726     		if (ret) {
vvv     CID 1527270:    (OVERRUN)
vvv     Overrunning array "zram->comps" of 4 8-byte elements at element index 4 (byte offset 39) using index "prio" (which evaluates to 4).
1727     			zcomp_stream_put(zram->comps[prio]);
1728     			return ret;
1729     		}
1730
1731     		class_index_new = zs_lookup_class_index(zram->mem_pool,
1732     							comp_len_new);
drivers/block/zram/zram_drv.c:1786 in zram_recompress()
1780     	handle_new = zs_malloc(zram->mem_pool, comp_len_new,
1781     			       __GFP_KSWAPD_RECLAIM |
1782     			       __GFP_NOWARN |
1783     			       __GFP_HIGHMEM |
1784     			       __GFP_MOVABLE);
1785     	if (IS_ERR_VALUE(handle_new)) {
vvv     CID 1527270:    (OVERRUN)
vvv     Overrunning array "zram->comps" of 4 8-byte elements at element index 4 (byte offset 39) using index "prio" (which evaluates to 4).
1786     		zcomp_stream_put(zram->comps[prio]);
1787     		return PTR_ERR((void *)handle_new);
1788     	}
1789
1790     	dst = zs_map_object(zram->mem_pool, handle_new, ZS_MM_WO);
1791     	memcpy(dst, zstrm->buffer, comp_len_new);
drivers/block/zram/zram_drv.c:1737 in zram_recompress()
1731     		class_index_new = zs_lookup_class_index(zram->mem_pool,
1732     							comp_len_new);
1733
1734     		/* Continue until we make progress */
1735     		if (class_index_new >= class_index_old ||
1736     		    (threshold && comp_len_new >= threshold)) {
vvv     CID 1527270:    (OVERRUN)
vvv     Overrunning array "zram->comps" of 4 8-byte elements at element index 4 (byte offset 39) using index "prio" (which evaluates to 4).
1737     			zcomp_stream_put(zram->comps[prio]);
1738     			continue;
1739     		}
1740
1741     		/* Recompression was successful so break out */
1742     		break;
drivers/block/zram/zram_drv.c:1721 in zram_recompress()
1715     		 * priority algorithm (or same algorithm).
1716     		 */
1717     		if (prio <= zram_get_priority(zram, index))
1718     			continue;
1719
1720     		num_recomps++;
vvv     CID 1527270:    (OVERRUN)
vvv     Overrunning array "zram->comps" of 4 8-byte elements at element index 4 (byte offset 39) using index "prio" (which evaluates to 4).
1721     		zstrm = zcomp_stream_get(zram->comps[prio]);
1722     		src = kmap_atomic(page);
1723     		ret = zcomp_compress(zstrm, src, &comp_len_new);
1724     		kunmap_atomic(src);
1725
1726     		if (ret) {
drivers/block/zram/zram_drv.c:1710 in zram_recompress()
1704     	class_index_old = zs_lookup_class_index(zram->mem_pool, comp_len_old);
1705     	/*
1706     	 * Iterate the secondary comp algorithms list (in order of priority)
1707     	 * and try to recompress the page.
1708     	 */
1709     	for (; prio < prio_max; prio++) {
vvv     CID 1527270:    (OVERRUN)
vvv     Overrunning array "zram->comps" of 4 8-byte elements at element index 4 (byte offset 39) using index "prio" (which evaluates to 4).
1710     		if (!zram->comps[prio])
1711     			continue;
1712
1713     		/*
1714     		 * Skip if the object is already re-compressed with a higher
1715     		 * priority algorithm (or same algorithm).

If this is a false positive, please let us know so we can mark it as
such, or teach the Coverity rules to be smarter. If not, please make
sure fixes get into linux-next. :) For patches fixing this, please
include these lines (but double-check the "Fixes" first):

Reported-by: coverity-bot <keescook+coverity-bot@...omium.org>
Addresses-Coverity-ID: 1527270 ("OVERRUN")
Fixes: 03e6c729aa64 ("zram: introduce recompress sysfs knob")

Thanks for your attention!

-- 
Coverity-bot