Re: [PATCH] mm/nommu: Reject wrapping ranges in access_remote_vm()

["Lorenzo Stoakes (ARM)" <ljs@kernel.org>]

BTW always feel free to nag if you're not getting review! Something things
get missed. (Though I'd say wait at least a couple weeks before doing
that!)

On Wed, Sep 09, 2026 at 09:42:31AM +0300, Anastasios Papagiannis wrote:
> The NOMMU implementation of access_process_vm() rejects address ranges
> whose end wraps around, but access_remote_vm() bypasses this check even
> though both functions delegate to __access_remote_vm().
>
> Move the wraparound check into __access_remote_vm() so it applies to
> both entry points.
>
> This is originally reported in [1].
>
> [1] https://lore.kernel.org/bpf/4ef240a5bea36ff84df9589671367832860795159386a4c8fba546a0fa8b786f@mail.kernel.org/

Probably better to drop this big and make this a Link: tag.

>
> Fixes: f55f199b7d76 ("NOMMU: implement access_remote_vm")

Cc: stable I think?

> Signed-off-by: Anastasios Papagiannis <tasos.papagiannnis@gmail.com>

Seems reasonable to me! So:

Reviewed-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>

> ---
>  mm/nommu.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/mm/nommu.c b/mm/nommu.c
> index 498e01ee40b0..ed44510e3770 100644
> --- a/mm/nommu.c
> +++ b/mm/nommu.c
> @@ -1674,6 +1674,9 @@ static int __access_remote_vm(struct mm_struct *mm, unsigned long addr,
>  	struct vm_area_struct *vma;
>  	int write = gup_flags & FOLL_WRITE;
>
> +	if (addr + len < addr)
> +		return 0;
> +
>  	if (mmap_read_lock_killable(mm))
>  		return 0;
>
> @@ -1727,9 +1730,6 @@ int access_process_vm(struct task_struct *tsk, unsigned long addr, void *buf, in
>  {
>  	struct mm_struct *mm;
>
> -	if (addr + len < addr)
> -		return 0;
> -
>  	mm = get_task_mm(tsk);
>  	if (!mm)
>  		return 0;
>
> base-commit: 0d9ff90a5422cc7509258aaaba1e7481df4d332a
> --
> 2.55.0
>

--
Cheers, Lorenzo