drivers/xen/gntdev.c:817 gntdev_get_page() warn: mask and shift to zero: expr='(addr & ~(~((1 << 12) - 1))) >> 12'

drivers/xen/gntdev.c:817 gntdev_get_page() warn: mask and shift to zero: expr='(addr & ~(~((1 << 12) - 1))) >> 12'

[Dan Carpenter]

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head:   62f4c998b297cf233997a2b4cd6fc2d2df0319c9
commit: d70242427110123b65c095594eb74a703d3af156 ARM: rework ARM11 CPU selection logic
config: arm-randconfig-r2200-20260924 (https://download.01.org/0day-ci/archive/20260924/202609241805.VsLzGPLn-lkp@intel.com/config)
compiler: arm-linux-gnueabi-gcc (GCC) 10.5.0
smatch: v0.5.0-9187-g5189e3fb

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Fixes: d70242427110 ("ARM: rework ARM11 CPU selection logic")
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>
| Closes: https://lore.kernel.org/r/202609241805.VsLzGPLn-lkp@intel.com/

smatch warnings:
drivers/xen/privcmd.c:488 privcmd_ioctl_mmap_batch() warn: potential user controlled sizeof overflow 'm.num * 8' '0-u32max * 8'
drivers/xen/privcmd.c:495 privcmd_ioctl_mmap_batch() warn: potential user controlled sizeof overflow 'm.num * (4)' '0-u32max * 4'

vim +817 drivers/xen/gntdev.c
   470  static long privcmd_ioctl_mmap_batch(
   471          struct file *file, void __user *udata, int version)
   472  {
   473          struct privcmd_data *data = file->private_data;
   474          int ret;
   475          struct privcmd_mmapbatch_v2 m;
   476          struct mm_struct *mm = current->mm;
   477          struct vm_area_struct *vma;
   478          unsigned long nr_pages;
   479          LIST_HEAD(pagelist);
   480          struct mmap_batch_state state;
   481  
   482          switch (version) {
   483          case 1:
   484                  if (copy_from_user(&m, udata, sizeof(struct privcmd_mmapbatch)))
   485                          return -EFAULT;
   486                  /* Returns per-frame error in m.arr. */
   487                  m.err = NULL;
   488                  if (!access_ok(m.arr, m.num * sizeof(*m.arr)))
                                              ^^^^^^^^^^^^^^^^^^^^^^

   489                          return -EFAULT;
   490                  break;
   491          case 2:
   492                  if (copy_from_user(&m, udata, sizeof(struct privcmd_mmapbatch_v2)))
   493                          return -EFAULT;
   494                  /* Returns per-frame error code in m.err. */
   495                  if (!access_ok(m.err, m.num * (sizeof(*m.err))))
                                              ^^^^^^^^^^^^^^^^^^^^^^^
These integer overflow bugs are from 2012, but I guess your patch exposed
the arm32 build to the zero day bot.  The bugs only affect 32bit systems.

   496                          return -EFAULT;
   497                  break;
   498          default:
   499                  return -EINVAL;
   500          }
   501  
   502          /* If restriction is in place, check the domid matches */
   503          if (data->domid != DOMID_INVALID && data->domid != m.dom)
   504                  return -EPERM;
   505  


--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

Re: drivers/xen/gntdev.c:817 gntdev_get_page() warn: mask and shift to zero: expr='(addr & ~(~((1 << 12) - 1))) >> 12'

[Arnd Bergmann]

On Thu, Sep 24, 2026, at 21:39, Dan Carpenter wrote:

>    489                          return -EFAULT;
>    490                  break;
>    491          case 2:
>    492                  if (copy_from_user(&m, udata, sizeof(struct 
> privcmd_mmapbatch_v2)))
>    493                          return -EFAULT;
>    494                  /* Returns per-frame error code in m.err. */
>    495                  if (!access_ok(m.err, m.num * (sizeof(*m.err))))
>                                               ^^^^^^^^^^^^^^^^^^^^^^^
> These integer overflow bugs are from 2012, but I guess your patch 
> exposed
> the arm32 build to the zero day bot.  The bugs only affect 32bit 
> systems.

Right, the randconfig came up with an ARMv6 Xen build, which was not
possible before my patch. I'm sure this was reported for other configs
before and just showed up as introduced by my patch here.

This is clearly a bug but it does look harmless to me, as it only
results in the userspace corrupting itself when passing invalid
data.

      Arnd

Re: drivers/xen/gntdev.c:817 gntdev_get_page() warn: mask and shift to zero: expr='(addr & ~(~((1 << 12) - 1))) >> 12'

[Dan Carpenter]

On Fri, Sep 25, 2026 at 08:43:54AM +0200, Arnd Bergmann wrote:
> On Thu, Sep 24, 2026, at 21:39, Dan Carpenter wrote:
> 
> >    489                          return -EFAULT;
> >    490                  break;
> >    491          case 2:
> >    492                  if (copy_from_user(&m, udata, sizeof(struct 
> > privcmd_mmapbatch_v2)))
> >    493                          return -EFAULT;
> >    494                  /* Returns per-frame error code in m.err. */
> >    495                  if (!access_ok(m.err, m.num * (sizeof(*m.err))))
> >                                               ^^^^^^^^^^^^^^^^^^^^^^^
> > These integer overflow bugs are from 2012, but I guess your patch 
> > exposed
> > the arm32 build to the zero day bot.  The bugs only affect 32bit 
> > systems.
> 
> Right, the randconfig came up with an ARMv6 Xen build, which was not
> possible before my patch. I'm sure this was reported for other configs
> before and just showed up as introduced by my patch here.
> 
> This is clearly a bug but it does look harmless to me, as it only
> results in the userspace corrupting itself when passing invalid
> data.

In ancient times, these access_ok() overflows were a much bigger deal.
Easy to solve with a size_mul(m.num, sizeof(*m.err)).

regards,
dan carpenter