From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D8B9524BBF4 for ; Wed, 10 Jun 2026 01:27:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781054827; cv=none; b=lKmdzK5tHIrwP0r/BkyTuwsgbG9LBaFlpK0+jHzZ/ffI6mDKGVrKPmFPCyKeF0kHYVN0cD7zs57IO7raOf87ojvCETmLpIBDC97ySUPrifUP4PgrbCi2PXeiN/k66KovbjiEzKhQ89QjWLD1Cu1462iXSftvFTKUb+/Z9q++FOA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781054827; c=relaxed/simple; bh=w6Z8hOHeOEwEBMUXGAjMw/d5t27NR9gsOMmG+JxUYhI=; h=Date:From:To:Cc:Subject:Message-Id:In-Reply-To:References: Mime-Version:Content-Type; b=muGgtR6bwvOm7XQa7R3ISFgLoxaOdKZdVNvkPN7pfXUxM+v5P8cFd5NUO497M2J/hpzzi+CCMbhqJU9LHaOzXxN1r/NUBC1zcY+UqJrw2fn1q+nlRL5R12lr8WV9uoyQVH86s94mvC3JXQs7SXReQLmQWl1eaKpixwJFB7tHVQQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux-foundation.org header.i=@linux-foundation.org header.b=I5mmvD40; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux-foundation.org header.i=@linux-foundation.org header.b="I5mmvD40" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 29B741F00893; Wed, 10 Jun 2026 01:27:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux-foundation.org; s=korg; t=1781054826; bh=CbufI5UN7haAr2GXCIUXNFjbjTsAYfOBZpq9LnBznZI=; h=Date:From:To:Cc:Subject:In-Reply-To:References; b=I5mmvD40Yv2kgScp4/uhuaxnCLTJ4Sw/z13rBmQ2bslNqzv2/P7iyCgaG8oE+6FZe ClXyZ8aqO+72QW0O8k0+s6bPMzMAXgdjdWu1NWLu3r6uTnjXGNwo6ScG9jBLd1Blcq 3XMMVH7mM4lShFrSTt/MHITyxprk9BN675b8weE0= Date: Tue, 9 Jun 2026 18:27:05 -0700 From: Andrew Morton To: Samuel Moelius Cc: David Hildenbrand , Jason Gunthorpe , John Hubbard , Peter Xu , linux-mm@kvack.org (open list:MEMORY MANAGEMENT - GUP (GET USER PAGES)), linux-kernel@vger.kernel.org (open list) Subject: Re: [PATCH] mm/gup_test: reject wrapped user ranges Message-Id: <20260609182705.7b3a46e7c4661bd55f8561eb@linux-foundation.org> In-Reply-To: <20260609004814.1240586.6294d614ac80.gup-test-range-end-wrap@trailofbits.com> References: <20260609004814.1240586.6294d614ac80.gup-test-range-end-wrap@trailofbits.com> X-Mailer: Sylpheed 3.8.0beta1 (GTK+ 2.24.33; x86_64-pc-linux-gnu) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit On Tue, 9 Jun 2026 00:48:15 +0000 Samuel Moelius wrote: > gup_test accepts an address and size from the debugfs ioctl and > repeatedly compares against addr + size. If that addition wraps, the > loop can be skipped and the ioctl returns success with size rewritten to > zero. > > Compute the end address once with overflow checking and use that checked > end for the loop bounds. > Looks sane, thanks. > --- a/mm/gup_test.c > +++ b/mm/gup_test.c > @@ -105,11 +105,15 @@ static int __gup_test_ioctl(unsigned int cmd, > unsigned long i, nr_pages, addr, next; > long nr; > struct page **pages; > + unsigned long end; > int ret = 0; > bool needs_mmap_lock = > cmd != GUP_FAST_BENCHMARK && cmd != PIN_FAST_BENCHMARK; > > - if (gup->size > ULONG_MAX) > + if (gup->addr > ULONG_MAX || gup->size > ULONG_MAX) > + return -EINVAL; > + if (check_add_overflow((unsigned long)gup->addr, > + (unsigned long)gup->size, &end)) I wonder why those fields were made __u64 instead of ulong. > return -EINVAL; > > nr_pages = gup->size / PAGE_SIZE; > @@ -125,13 +129,13 @@ static int __gup_test_ioctl(unsigned int cmd, > i = 0; > nr = gup->nr_pages_per_call; > start_time = ktime_get(); > - for (addr = gup->addr; addr < gup->addr + gup->size; addr = next) { > + for (addr = gup->addr; addr < end; addr = next) { > if (nr != gup->nr_pages_per_call) > break; > > next = addr + nr * PAGE_SIZE; Sashiko AI review identified a pre-existing possible overflow here on 32-bit machines. https://sashiko.dev/#/patchset/20260609004814.1240586.6294d614ac80.gup-test-range-end-wrap@trailofbits.com > - if (next > gup->addr + gup->size) { > - next = gup->addr + gup->size; > + if (next > end) { > + next = end; > nr = (next - addr) / PAGE_SIZE; > }