diff options
| author | Dan Carpenter <error27@gmail.com> | 2026-09-15 19:37:27 +0300 |
|---|---|---|
| committer | Andrew Morton <akpm@linux-foundation.org> | 2026-10-12 21:26:13 -0700 |
| commit | b59925301211ccc351d98d70b11f6d1b2c63150f (patch) | |
| tree | fa680f5839d7618f7944dd90c1067b87bb83335c /tools/perf/scripts/python | |
| parent | adbb0adb434d55bd02b18c8de6356f954a077c79 (diff) | |
mm/hmm/test: reject overflowing page counts
The number of pages comes directly from userspace. Shifting a value
larger than ULONG_MAX >> PAGE_SHIFT discards its high bits before the
existing end-address check. A request for a huge number of pages can
therefore be accepted and processed as a much smaller request.
Reject page counts that cannot be represented as a byte size before
performing the shift.
So far as ChatGPT and I can tell this doesn't cause an issue in practice
but preventing this integer overflow is the correct thing to do.
Link: https://lore.kernel.org/6f0d39089e938d4f53dc72632eb84aca34de7015.1789457465.git.error27@gmail.com
Fixes: b2ef9f5a5cb3 ("mm/hmm/test: add selftest driver for HMM")
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Alistair Popple <apopple@nvidia.com>
Assisted-by: ChatGPT:gpt-5
Cc: Jason Gunthorpe <jgg@ziepe.ca>
Cc: Jerome Glisse <jglisse@redhat.com>
Cc: Leon Romanovsky <leon@kernel.org>
Cc: Ralph Campbell <rcampbell@nvidia.com>
Cc: Wei Yongjun <weiyongjun1@huawei.com>
Diffstat (limited to 'tools/perf/scripts/python')
0 files changed, 0 insertions, 0 deletions
