diff options
| author | Dan Carpenter <error27@gmail.com> | 2026-09-15 19:37:27 +0300 |
|---|---|---|
| committer | Andrew Morton <akpm@linux-foundation.org> | 2026-09-29 23:13:28 -0700 |
| commit | 7dd01a31736382d6844d2cfab93a1dde2c3a0584 (patch) | |
| tree | 66f81cbbcb8b8cd56edef7b98985628acc44f660 /scripts/patch-kernel | |
| parent | bd2e6a28a56a4bf324cc48157c247bc94d66d93d (diff) | |
| download | linux-next-7dd01a31736382d6844d2cfab93a1dde2c3a0584.tar.gz linux-next-7dd01a31736382d6844d2cfab93a1dde2c3a0584.zip | |
mm/hmm/test: reject overflowing page counts
The number of pages comes directly from userspace. Shifting a value
larger than ULONG_MAX >> PAGE_SHIFT discards its high bits before the
existing end-address check. A request for a huge number of pages can
therefore be accepted and processed as a much smaller request.
Reject page counts that cannot be represented as a byte size before
performing the shift.
So far as ChatGPT and I can tell this doesn't cause an issue in practice
but preventing this integer overflow is the correct thing to do.
Link: https://lore.kernel.org/6f0d39089e938d4f53dc72632eb84aca34de7015.1789457465.git.error27@gmail.com
Fixes: b2ef9f5a5cb3 ("mm/hmm/test: add selftest driver for HMM")
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Alistair Popple <apopple@nvidia.com>
Assisted-by: ChatGPT:gpt-5
Cc: Jason Gunthorpe <jgg@ziepe.ca>
Cc: Jerome Glisse <jglisse@redhat.com>
Cc: Leon Romanovsky <leon@kernel.org>
Cc: Ralph Campbell <rcampbell@nvidia.com>
Cc: Wei Yongjun <weiyongjun1@huawei.com>
Diffstat (limited to 'scripts/patch-kernel')
0 files changed, 0 insertions, 0 deletions
