diff options
| author | Samuel Moelius <sam.moelius@trailofbits.com> | 2026-06-09 03:48:15 +0300 |
|---|---|---|
| committer | Andrew Morton <akpm@linux-foundation.org> | 2026-06-21 21:37:37 +0300 |
| commit | e8ae6fd67021fafa9205330b3b248c9fc7216e0b (patch) | |
| tree | d18bc7aa9bca4ef921df99dcaffce97736bc5898 /scripts | |
| parent | 5419cac89c0224b5acdbcda183a3c4809510ce95 (diff) | |
| download | linux-e8ae6fd67021fafa9205330b3b248c9fc7216e0b.tar.xz | |
mm/gup_test: reject wrapped user ranges
gup_test accepts an address and size from the debugfs ioctl and repeatedly
compares against addr + size. If that addition wraps, the loop can be
skipped and the ioctl returns success with size rewritten to zero.
Compute the end address once with overflow checking and use that checked
end for the loop bounds.
Assisted-by: Codex:gpt-5.5-cyber-preview
Link: https://lore.kernel.org/20260609004814.1240586.6294d614ac80.gup-test-range-end-wrap@trailofbits.com
Signed-off-by: Samuel Moelius <sam.moelius@trailofbits.com>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Cc: Jason Gunthorpe <jgg@ziepe.ca>
Cc: John Hubbard <jhubbard@nvidia.com>
Cc: Peter Xu <peterx@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Diffstat (limited to 'scripts')
0 files changed, 0 insertions, 0 deletions