From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wr1-f53.google.com (mail-wr1-f53.google.com [209.85.221.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4712F372B57 for ; Mon, 5 Oct 2026 06:53:07 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.53 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791183188; cv=none; b=pezXIrU5RBpc1yPkf92QoWMGznG5Ba+e1jQ2B3EDDfEJuMRvqYlRao6mkBaT8bCekfeemGBXL5j+5bxCxGuSxt9gaOetWLieCXj+rFz93BHt/IiawSvvPutLZuN0YxfvC135MhjAYydD75WtmEyaySS8cyYZCnZCGAVq6cMuJR4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791183188; c=relaxed/simple; bh=kzrMF3ZVCeJ+AX/Q0Wt8VSe/IHVxnFDYfEawSK8ROl8=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Sp1jNZbqv0QbhA+1ewnAjABk0nH6eW0csvce8Y/rV7upJdg/ULCcQP5TWHxyUye1najrV2L/2PgThmviH+Myxm4AxSJFlxbybrnBRO+JSwuBCCC0w9V+NoELh0+Qsv56H6WrUOpzcZgwBr9kqyZO+q/UOleHkwSrU14egtyY6ZI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=IH7pAhwO; arc=none smtp.client-ip=209.85.221.53 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="IH7pAhwO" Received: by mail-wr1-f53.google.com with SMTP id ffacd0b85a97d-48441a2ba1bso738168f8f.1 for ; Sun, 04 Oct 2026 23:53:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791183185; x=1791787985; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=J3qCoCe5HgkC4I11/aszYLTcw78qjIhlSBPgmqbtI6o=; b=IH7pAhwO4c/ZHHo6Z1nFbvh8MJQzvRh8i2GB9yrpMXmKHWfv0L7nfbg6M9NeBcHM+J ySDp5PVsNvFBlAwPHhrVvZurrNChGJxHo3EUCmiN7+n3uT/1VLWEeH6zrLSm+zh34F22 jGLp77SL6lBvNWm7oJ5jizqsIdf8WMEAPxmi1/+StpQsRa/05kYg6ItVu+2qgb8AL55T VHTNO7TZ+MRsj8Q3DEB/hl0B2ZOnE31bbAUB9L+OQyMQTmiitavNnxL3DAOfxeN4rtkx 3yk7qbrWaLDc3RQeGxFh98w21p6g5MXbzZKHfooR6OQoH7aGdZIJA0Zm13oaQEzt5e5D T7+w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791183185; x=1791787985; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=J3qCoCe5HgkC4I11/aszYLTcw78qjIhlSBPgmqbtI6o=; b=pAwSE+M4RsP40ayYR53G3pypSq6ZKdYWO+uUMzwj6VUr5i62Mutz89iR5d38V8hL2b F2r31fzal4bMCw+nQb0aSNMwwZxBhvhNE1PrNhg21uc4m8aL0hcyz/+VzfEMOPOBAc9O B0ZvFooUAGyT08CE3Z3+2iD9vLcco7YJvKabhKsBsftlMifyxShgXBQyedjuMJxCbuu3 xe5xsSwvma+62o/YbpGTEX3V1cZcB7i2JaR7W94eG9vpVtMoSQI2b8nF4hMnl1Vpntav A3eTUHWjcv8i4iPqtrqQ9dnGc8/fXtZ/1Qb+mvNW4beoRtRxiPIwdNX06Dn/L1UtUjy7 kyTQ== X-Forwarded-Encrypted: i=1; AKwUvBwl3e8VK4nICiTLo9x3vWNH2iZUxzRd/oj5TQ5g1KOagswJ/4skm7CcuRaBkVokJXQoDW4TtWkBAEgGoGs=@vger.kernel.org X-Gm-Message-State: AFuF++moeEsWK8uqO7iAXF44Upky+CU8wKGIDKE4TjehGe/YdsT6C+Mc 8HgFWd17rvWZY1Hzxjf4fex7Tucmp28yevLKEUnzADJ+8rS5zcrc4sQ2 X-Gm-Gg: AYBFou2GlgyI0xaCH+PUIoJREhN1IP89tuAr++UkH/w/xAjEXTLT+jCr5HBy4hco9hl 57wGDTJVxJbWFS/MYHIJfo9Ciu1SXLGgapRY1ZVSPKSQTGYhS7RypFduwHMRzGDbINx1i741Qve BkThZkC9Z/OcaDmYGBHfKtXRKpPKs0WtagldrkLbEOZE2aLruVGGYCKVIWeDFGlChPvkp49EnAj ZotxJ+SN2BIEIrUGeosb2+F19FxW7m2HnriiQDXlQX+c6KsR9VBx8A8peSZnIGN873j+YgfA8f1 dehZrYrdqf8Eoi7XRyYOl5WSbdQ7TFaMzKL/Wvx6k0mewxko6Nz1V6hVbCYqSmeuwXZhy7ilbZU 3P7Q6n0bJfoiDBtTRm6mwPwRGTHYPGVLYPciwdVsA/k0elu9QYDpmt8snijwOwchaOVExM9ycIO +T0WDhiSah/8QbEsAWy6hBL8jwbsQ+5imD0UMpzEPPCEhHxbBDkjkLhIk= X-Received: by 2002:a05:600c:a116:b0:4a1:6517:ccf1 with SMTP id 5b1f17b1804b1-4a1680e9524mr72604545e9.9.1791183185355; Sun, 04 Oct 2026 23:53:05 -0700 (PDT) Received: from nobara ([83.231.69.9]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-48c6308481dsm1247436f8f.3.2026.10.04.23.53.04 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 04 Oct 2026 23:53:04 -0700 (PDT) From: "Jose A. Perez de Azpillaga" To: Andrew Morton , "Liam R. Howlett" , Lorenzo Stoakes , David Hildenbrand , Shuah Khan Cc: Vlastimil Babka , Jann Horn , Pedro Falcato , Mike Rapoport , Suren Baghdasaryan , Michal Hocko , linux-mm@kvack.org, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, "Jose A. Perez de Azpillaga" , Park Tae-sun Subject: [PATCH 2/3] mm/mlock: reject ranges that cannot be represented Date: Mon, 5 Oct 2026 08:46:30 +0200 Message-ID: <20261005065244.6935-3-azpijr@gmail.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20261005065244.6935-1-azpijr@gmail.com> References: <20261005065244.6935-1-azpijr@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit A length within a page of ULONG_MAX wraps when mlock() and munlock() round the range to pages. At an aligned address the length becomes 0 and the call is a silent success; at an unaligned one it becomes a single page, which is then locked or unlocked. An overflowing start + len is only caught in apply_vma_lock_flags(), after the RLIMIT_MEMLOCK check, so mlock() returns -ENOMEM without CAP_IPC_LOCK and -EINVAL with it. Return -EINVAL, as man 2 mlock documents, when start + len overflows or the end overflows when rounded up to a page. Doing this before can_do_mlock() also avoids making the result depend on RLIMIT_MEMLOCK/CAP_IPC_LOCK. Requests that get a silent success today now fail. Reported-by: Park Tae-sun Closes: https://lore.kernel.org/all/179066531783.50175.13377521828379196177@dgu.ac.kr/ Signed-off-by: Jose A. Perez de Azpillaga --- mm/mlock.c | 23 +++++++++++++++++++---- 1 file changed, 19 insertions(+), 4 deletions(-) diff --git a/mm/mlock.c b/mm/mlock.c index cc28e5d7413a..a9e2b90c058f 100644 --- a/mm/mlock.c +++ b/mm/mlock.c @@ -608,6 +608,7 @@ static __must_check int do_mlock(unsigned long start, size_t len, { unsigned long locked; unsigned long lock_limit; + unsigned long end; int error = -ENOMEM; start = untagged_addr(start); @@ -615,12 +616,19 @@ static __must_check int do_mlock(unsigned long start, size_t len, if (!len) return 0; + /* Reject a wrapping range before can_do_mlock() and the rlimit check. */ + end = start + len; + if (end < start) + return -EINVAL; + end = PAGE_ALIGN(end); + if (!end) + return -EINVAL; + start &= PAGE_MASK; + len = end - start; + if (!can_do_mlock()) return -EPERM; - len = PAGE_ALIGN(len + (offset_in_page(start))); - start &= PAGE_MASK; - lock_limit = rlimit(RLIMIT_MEMLOCK); lock_limit >>= PAGE_SHIFT; locked = len >> PAGE_SHIFT; @@ -676,6 +684,7 @@ SYSCALL_DEFINE3(mlock2, unsigned long, start, size_t, len, int, flags) SYSCALL_DEFINE2(munlock, unsigned long, start, size_t, len) { + unsigned long end; vma_flags_t flags = EMPTY_VMA_FLAGS; int ret; @@ -684,8 +693,14 @@ SYSCALL_DEFINE2(munlock, unsigned long, start, size_t, len) if (!len) return 0; - len = PAGE_ALIGN(len + (offset_in_page(start))); + end = start + len; + if (end < start) + return -EINVAL; + end = PAGE_ALIGN(end); + if (!end) + return -EINVAL; start &= PAGE_MASK; + len = end - start; if (mmap_write_lock_killable(current->mm)) return -EINTR; -- 2.55.0