From 1dfe4b276c23189394afb42d114ee8a54cc3aff2 Mon Sep 17 00:00:00 2001 From: Chris Mason Date: Sat, 31 Oct 2026 10:39:50 +0100 Subject: [PATCH] mm/gup: fix out-of-bounds write for nr_pages == 0 in GUP-fast With nr_pages == 0, GUP-fast still enters its page table walk and can write past the caller's page array. The old end <= start check caught empty ranges, but was replaced with an overflow check. Users such as OrangeFS can pass a zero page count derived from a userspace-supplied length. So let's return zero for nr_pages == 0 before starting the walk, just like GUP-slow. Fix generated by an LLM and sent by Chris Mason in private. Fixes: c28b1fc70390 ("mm/gup: reorganize internal_get_user_pages_fast()") Cc: stable@vger.kernel.org Signed-off-by: Chris Mason [ david: simplify description ] Reviewed-by: Lorenzo Stoakes (ARM) Acked-by: Muchun Song Tested-by: Muhammad Usama Anjum Link: https://patch.msgid.link/20261031-fixes_core-v3-21-d6437171ecc3@kernel.org Signed-off-by: David Hildenbrand (Arm) --- mm/gup.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/mm/gup.c b/mm/gup.c index cc4fa18783ce..1c2ac7c66c30 100644 --- a/mm/gup.c +++ b/mm/gup.c @@ -3215,6 +3215,9 @@ static int gup_fast_fallback(unsigned long start, unsigned long nr_pages, FOLL_PCI_P2PDMA | FOLL_HONOR_NUMA_FAULT))) return -EINVAL; + if (unlikely(!nr_pages)) + return 0; + if (gup_flags & FOLL_PIN) mm_set_has_pinned_flag(current->mm);