Re: [PATCH 2/2] pstore: reject persistent RAM zones too small for the buffer header

[Kees Cook]

On Mon, Sep 21, 2026 at 10:23:16PM +0200, Andrea Parri wrote:
> persistent_ram_buffer_map() computes
> 
> 	prz->buffer_size = size - sizeof(struct persistent_ram_buffer);
> 
> without checking that size is large enough to hold the header.  A
> ramoops zone configured with a tiny size (e.g. ramoops.pmsg_size=1)
> underflows buffer_size to a huge value, which defeats every bounds
> check in persistent_ram_write() and persistent_ram_write_user(); a
> write to /dev/pmsg0 then copies user data far past the end of the zone
> and corrupts kernel memory.
> 
> Reject zones that are not larger than the buffer header.
> 
> Fixes: 404a6043385de ("staging: android: persistent_ram: handle reserving and mapping memory")
> Cc: stable@xxxxxxxxxxxxxxx
> Assisted-by: LLM
> Signed-off-by: Andrea Parri <parri.andrea@xxxxxxxxx>
> ---
>  fs/pstore/ram_core.c | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/fs/pstore/ram_core.c b/fs/pstore/ram_core.c
> index b4ec8009b8dc9..ae941777037b8 100644
> --- a/fs/pstore/ram_core.c
> +++ b/fs/pstore/ram_core.c
> @@ -505,6 +505,12 @@ static int persistent_ram_buffer_map(phys_addr_t start, phys_addr_t size,
>  	prz->paddr = start;
>  	prz->size = size;
>  
> +	if (size <= sizeof(struct persistent_ram_buffer)) {
> +		pr_err("%s: persistent ram zone too small (%#llx bytes)\n",
> +		       prz->label, (unsigned long long)size);
> +		return -EINVAL;
> +	}

Whoops. Luckily it's all system-owner or hardware defined (hardware
probes, and boot params).

I wonder if it should return ENOSPC instead, though?

> +
>  	if (pfn_valid(start >> PAGE_SHIFT))
>  		prz->vaddr = persistent_ram_vmap(start, size, memtype);
>  	else
> -- 
> 2.53.0
> 

Thanks for finding this!

-- 
Kees Cook