From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qk1-f182.google.com (mail-qk1-f182.google.com [209.85.222.182]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C460B15E8B for ; Tue, 9 Jun 2026 00:49:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.222.182 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780966177; cv=none; b=anATvlq2ZyWSIM03ejGorTuyUIz4UkM9no5jjtes2tuJZTR+/54zts/T2MkFZhhvRI4yFld+5iYSqGzeN/Hmb704blWp3KhvLG7VnP+mfQxox7yVWxkWTK+G8n7c4gHdBZhLM1/ewgjtywMvhsjnLLUjfaYcEGf3F2NbtUcZ2pY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780966177; c=relaxed/simple; bh=ukLtIr+rbPUmSZ4lC2sXU7PvWIIxqbH+qmDZboDp+l4=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=pKWwueEqID4xiBLhFKZSKujMP/kRrheKiZfHbutMOxO91oRhjWLgadI2Nae0P6weP6lAWEjnBxYalNqlN3gfrX1diyK0OkirL4k6dM0Hyo40WpMtXCoRV1Grj2dXSVN9CwvcUjpvXBCQ2Ba3MVjSrhkGzDHktw/5oxldKyv3zd8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=trailofbits.com; spf=pass smtp.mailfrom=trailofbits.com; dkim=pass (2048-bit key) header.d=trailofbits.com header.i=@trailofbits.com header.b=i45pkEaB; arc=none smtp.client-ip=209.85.222.182 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=trailofbits.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=trailofbits.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=trailofbits.com header.i=@trailofbits.com header.b="i45pkEaB" Received: by mail-qk1-f182.google.com with SMTP id af79cd13be357-9157d3f2098so598322885a.3 for ; Mon, 08 Jun 2026 17:49:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=trailofbits.com; s=google; t=1780966175; x=1781570975; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=Y4KsfbPvhSMlGZi3sBd0gWqqCN3u7uRCcXc1rfpSpCY=; b=i45pkEaBWDuXAl+U+EZBEJo8m+mbfIg6uiYpXAcl0hkHsgrD9A+JxTdiLgYNHcJ3vC GIB8j/alxt/Ury5m5u5WotEaRJHrNYSf7irCYwgtmDnph/TCj9BCOP+hdz7jJ8bVd8jL gLJzhKWwDopta+cVd2YDKgsNZxs35wGwXSqiXmnMhFq8K2UfMftWUAI2Ne8fvJtqyMVr 5K0XPAU0lDqGtwsgffdNIIwxzZYdqlN/kxYfEWBfhtReCeI7xm0QvBdmPvEYOWhTCD2k l+hFP3ZbiHwzpCaf0YxXz3p6E2Xu5d6DvKQo4o0nZZVjzcRbFHXZ0melRYKxMNwE1+NG BiNw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780966175; x=1781570975; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=Y4KsfbPvhSMlGZi3sBd0gWqqCN3u7uRCcXc1rfpSpCY=; b=rWhbVgPNVfPtk2us+aHvTXwiy2mutUgF0V0ZoJ9az2VJkZ70jGiwBgnPsViN91G7/a clhquwvhAvEm4Tt+xvvldShmcldNc12lAdtLKNmJfqYMaxu8um6q7A3eH2wmJ9R56ANC KOjIU/plBBBf+uG9SXWdLdKW5RgN9Xt7Um3l7CB9z2DpvspVGZpZMWozH/r5GQMYUkMU 824NXFYFQhIXmqkxfrEDZ0ZfgXs0pEg/wgOzXYeeHotYo8KIROpHSaFowA3LHBrgWu80 WK6c9eh5sb/FWlViqci7BWjqv+myiXWcF1smCgbv6h9OH4zE7vpkAkDUN5dRh58wpFud UxLA== X-Forwarded-Encrypted: i=1; AFNElJ8wMr3PP62DzlcKikHH9+6R0AuVBElju9obIF1rGzOlUF7Bwooh47pFbMt9T+lqzLXfS6VL6fKYoicubV4=@vger.kernel.org X-Gm-Message-State: AOJu0Yxu2RgKHK1odBpNYYCvI9vVakgyVzSNK3IMCVo7fn9Lu6/wSI5N DYVAbrHt+Ak6ZzxQ40RG+NirPWuIS0aRZlwvdyVX0pQ/dCoFbEMSberWaapKhpzdbI4= X-Gm-Gg: Acq92OG3eW9HqR/PH1zI6NakXGsqrj9+Ipah7ZBXMX4ovExfnWOzVYHRN4RT0w/Rhib jTrmm6N7Qxgint91le8juT9mIK9zTYy12Cy4lylPcCXnoFzeGEGRO/Ki0D61/UGiV5dUGHpFMmU i2bXjwqLkwlLwb+GDdwIminB3W+DcduxmtPyaRBdPsOR9wPzZxBJ6YzjjOcJIFBQ8THtqC6hDPe gghBO4NEiC6OVoxRduXHewyHil/54mKCTsQFZEs89ZNi30D+5OBCjUTBkwjOLCxXdOsfKilwG/b OI7LoGOwbV23dsDn0BFhE+kYneABgw/qekASKjAwsGGtVupOeLTVbTjP95wn27sIxknuKk61mDJ jMNQT2aSlIcWyqLCfAA0sikE1naMPKOSjI+JjMEXtCCkjJGG1HrqOmOT5uWP4MylLd41WjcnoB0 Pg0JsXzeShvIPJybXbwSHuPfoso/AQLdKX5CPztA== X-Received: by 2002:a05:620a:4886:b0:915:9efe:6dd8 with SMTP id af79cd13be357-915a9db8256mr2803430885a.42.1780966174620; Mon, 08 Jun 2026 17:49:34 -0700 (PDT) Received: from localhost ([161.35.96.86]) by smtp.gmail.com with UTF8SMTPSA id af79cd13be357-9158a00840dsm2079594685a.1.2026.06.08.17.49.33 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Mon, 08 Jun 2026 17:49:34 -0700 (PDT) From: Samuel Moelius To: Andrew Morton Cc: Samuel Moelius , David Hildenbrand , Jason Gunthorpe , John Hubbard , Peter Xu , linux-mm@kvack.org (open list:MEMORY MANAGEMENT - GUP (GET USER PAGES)), linux-kernel@vger.kernel.org (open list) Subject: [PATCH] mm/gup_test: reject wrapped user ranges Date: Tue, 9 Jun 2026 00:48:15 +0000 Message-ID: <20260609004814.1240586.6294d614ac80.gup-test-range-end-wrap@trailofbits.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit gup_test accepts an address and size from the debugfs ioctl and repeatedly compares against addr + size. If that addition wraps, the loop can be skipped and the ioctl returns success with size rewritten to zero. Compute the end address once with overflow checking and use that checked end for the loop bounds. Assisted-by: Codex:gpt-5.5-cyber-preview Signed-off-by: Samuel Moelius --- mm/gup_test.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/mm/gup_test.c b/mm/gup_test.c index 9dd48db897b9..eb4c9cda16ed 100644 --- a/mm/gup_test.c +++ b/mm/gup_test.c @@ -105,11 +105,15 @@ static int __gup_test_ioctl(unsigned int cmd, unsigned long i, nr_pages, addr, next; long nr; struct page **pages; + unsigned long end; int ret = 0; bool needs_mmap_lock = cmd != GUP_FAST_BENCHMARK && cmd != PIN_FAST_BENCHMARK; - if (gup->size > ULONG_MAX) + if (gup->addr > ULONG_MAX || gup->size > ULONG_MAX) + return -EINVAL; + if (check_add_overflow((unsigned long)gup->addr, + (unsigned long)gup->size, &end)) return -EINVAL; nr_pages = gup->size / PAGE_SIZE; @@ -125,13 +129,13 @@ static int __gup_test_ioctl(unsigned int cmd, i = 0; nr = gup->nr_pages_per_call; start_time = ktime_get(); - for (addr = gup->addr; addr < gup->addr + gup->size; addr = next) { + for (addr = gup->addr; addr < end; addr = next) { if (nr != gup->nr_pages_per_call) break; next = addr + nr * PAGE_SIZE; - if (next > gup->addr + gup->size) { - next = gup->addr + gup->size; + if (next > end) { + next = end; nr = (next - addr) / PAGE_SIZE; } -- 2.43.0