From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f49.google.com (mail-wm1-f49.google.com [209.85.128.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 79D08377EBC for ; Thu, 25 Jun 2026 08:57:49 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.49 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782377870; cv=none; b=b8jsXnI+IynuvctPWNvRxtMmts+Ee4laD0KPXyoLIkn19jAJG4wFizgV3ppGofw8gleKygVytaEONsEBTE3WOnU3xtjNluApUPIx8mLMob+Eb34tFK1W1a0MnIxmLAPeJVfa/PkoKgtbfIwu9iKq7HzWOnJ6ZjFP1L9xwSOz85E= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782377870; c=relaxed/simple; bh=JkIeH8G3UDsIunXCm6he5FJmTCacmkG7UZWOLNyDQjQ=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=WP8xT2hV9fADqt1GJV4SFVoLoguV94wHY8fD5fVN+Cwh6IT14uSgT/ehSnBZJeGm2TucfJ4qDpUzXHE2guN9iVeFN6MMfQIl9GsCz4wQe8MzNc64QbiIGQeQ8M18VurIRS5HI0/g6PsxQN9j77ASMFXviC4/ggPPpLBfG/nYrV8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Pla0pJCR; arc=none smtp.client-ip=209.85.128.49 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Pla0pJCR" Received: by mail-wm1-f49.google.com with SMTP id 5b1f17b1804b1-490b64c8311so24268505e9.3 for ; Thu, 25 Jun 2026 01:57:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1782377868; x=1782982668; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=I7mK938UvamZb4f9XlJ0eXBktak5gapPH+AoT8mY1/M=; b=Pla0pJCRWGHA+VqBHhTjXQf7yxkY33iT+6WOYcW5SdxCJ0qykyeXPLDYptL+ZyfeRE h5kN+/Lyt6OUdL1wAIT9w39P0bvW+/LIU4FeUGl9cuJ0w7q6GS1YND1vuUqkOP91luFo gmBK2vImqIZg0Tv6Zg/dr1o/T/SoKspQz99hNdb3F8aewudUZf9cAkWvga+VIM4CI4Ao PtZc7xyJkFrg5G9tH/ks2NAaL8NLgceTi1zzJplBTsVna3rUEhrmW0FbHcaCX1HCc2Kq +wWBWUtjkoF5wgN/t1pJ6LQ4YHZ5hLNWFm6v41BqG05U5JOFdE2OLTdC9FXVq4azn3iI af6g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782377868; x=1782982668; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=I7mK938UvamZb4f9XlJ0eXBktak5gapPH+AoT8mY1/M=; b=jxs6V6RveM0MyzbGaxnjSzXN86feEARgg0VgwRc3Vy1woe/7kdpkFDq4WRb1VDV9IS qHI3N99WJhdERL4hLaPGWgOLhhnIuoFPErE6YG3atyXmeaZwwxEMgFIWFcCq1zaqVxAX yiQhQ9qERFwHDW8gmfYF21Jh1Xo/xwoPGokxGc1ybJBFQx3jEr1MeRnDinIkYrzxTing mtNU668KISrXWnkHYHJuo05UKM42blnbZBkmE4rrdKd2IDps2F5P0aG4bBzASBbyRohv bC/M7HWXxZWV8ysSfvdchY9WcmrG3B/Oda8Iz1xw4PyPsWqADSLz1kQH581Z4ZcDzUyS q2kg== X-Forwarded-Encrypted: i=1; AFNElJ9rhG2ZgB9jH2MSo9TRXdjzbGedomWSyX7cl9k0OmKV2s4MTHQbf8b/4aBhRMcchc2FFsiidfYUh32s8gU=@vger.kernel.org X-Gm-Message-State: AOJu0Yz3CB5+Bi5V1rZBqIFMstetVKR8Q7erWz+QGNbd0Sjhsy7rjN9F PwENoIHxmUBLkTBIVxCOGMh5tdJkJ+ACuxhzgZ+UsvOQe1EEDRWm4bB7 X-Gm-Gg: AfdE7cmyA2yOSV/BY3EA+7cxgk1e/0Hnt3uNU0x4qW/lk6hCUcFT4isyvKaybkFoDA1 avbzNpKnIWuaYCUFZZCJS9ejvf6UUSld2wWQbg+AokfisUzqmt6vbzWfV3wJ+flW8QSn2ksOUPk Y4+pScWlXUJHw4VqAFumKV2OUvXCPkBuYQjHOxmP9mz3WISWPiep8VCYdX/3B1Fjn2q+I25ekyk JW1/11C7KU9AhHK7rhVoEsN/5KgQ54QtYCPkHE86KEohBKdr7n30SlxnbbietjJFoO0krhOtTP9 ocWOBv2SLRVi0BGZnry+bHjBzJ4NaHmIPjJbwyN38Ax9J55hgK6tUKsVedUQlh+ohRUk7F7ZKTt j4R8VVR+NWBs+onXn8OQb5DkW16oItKkHqOeOtca3ilkDgXti5awiXLkrEZJi7jnbxBBhQRzdQq hXDXbr3FF/C5c40cJiwJrNT/gp0A== X-Received: by 2002:a05:600c:a12:b0:490:e19b:bd99 with SMTP id 5b1f17b1804b1-492668ad891mr20377325e9.30.1782377867583; Thu, 25 Jun 2026 01:57:47 -0700 (PDT) Received: from Dev-Null-MSI ([2a0d:3344:52ac:a808:98a4:4381:be45:536f]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4926541e03asm40015555e9.2.2026.06.25.01.57.46 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 25 Jun 2026 01:57:47 -0700 (PDT) From: Yousef Alhouseen To: Gerd Hoffmann , Vivek Kasireddy , Sumit Semwal , =?UTF-8?q?Christian=20K=C3=B6nig?= Cc: dri-devel@lists.freedesktop.org, linux-media@vger.kernel.org, linaro-mm-sig@lists.linaro.org, linux-kernel@vger.kernel.org, Yousef Alhouseen Subject: [PATCH] dma-buf: udmabuf: make list limit unsigned Date: Thu, 25 Jun 2026 10:57:35 +0200 Message-ID: <20260625085735.4488-1-alhouseenyousef@gmail.com> X-Mailer: git-send-email 2.54.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit UDMABUF_CREATE_LIST uses list_limit only as an upper bound for the unsigned entry count supplied by userspace. Negative values have no useful meaning and complicate the bounds check. Make the module parameter unsigned and keep the checked array copy so large counts cannot wrap the allocation size before udmabuf_create() walks the copied list. Signed-off-by: Yousef Alhouseen --- drivers/dma-buf/udmabuf.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/drivers/dma-buf/udmabuf.c b/drivers/dma-buf/udmabuf.c index b4078ec84..620113df3 100644 --- a/drivers/dma-buf/udmabuf.c +++ b/drivers/dma-buf/udmabuf.c @@ -16,8 +16,8 @@ #include #include -static int list_limit = 1024; -module_param(list_limit, int, 0644); +static uint list_limit = 1024; +module_param(list_limit, uint, 0644); MODULE_PARM_DESC(list_limit, "udmabuf_create_list->count limit. Default is 1024."); static int size_limit_mb = 64; @@ -469,12 +469,10 @@ static long udmabuf_ioctl_create_list(struct file *filp, unsigned long arg) struct udmabuf_create_list head; struct udmabuf_create_item *list; int ret = -EINVAL; - int limit; if (copy_from_user(&head, (void __user *)arg, sizeof(head))) return -EFAULT; - limit = READ_ONCE(list_limit); - if (!head.count || limit <= 0 || head.count > limit) + if (!head.count || head.count > READ_ONCE(list_limit)) return -EINVAL; list = memdup_array_user((void __user *)(arg + sizeof(head)), head.count, sizeof(*list)); -- 2.54.0