From 21a3888d3d2f87b7f15ccea1f0befd57346fe899 Mon Sep 17 00:00:00 2001 From: "David Hildenbrand (Arm)" Date: Sat, 31 Oct 2026 10:39:51 +0100 Subject: [PATCH] mm/gup: check for overflow when converting nr_pages to bytes in GUP-fast The overflow check in gup_fast_fallback() only covers the addition to start. The preceding nr_pages << PAGE_SHIFT can already have truncated the length on 32bit. Users such as RapidIO's rio_dma_transfer() can derive such page counts from a 64-bit userspace length. Let's just check_shl_overflow() to reject any such overflow with -EOVERFLOW early. Fixes: c28b1fc70390 ("mm/gup: reorganize internal_get_user_pages_fast()") Cc: stable@vger.kernel.org Reviewed-by: Lorenzo Stoakes (ARM) Acked-by: Muchun Song Reviewed-by: Barry Song Tested-by: Muhammad Usama Anjum Link: https://patch.msgid.link/20261031-fixes_core-v3-22-d6437171ecc3@kernel.org Signed-off-by: David Hildenbrand (Arm) --- mm/gup.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/mm/gup.c b/mm/gup.c index 1c2ac7c66c30..ba4907b35232 100644 --- a/mm/gup.c +++ b/mm/gup.c @@ -3225,8 +3225,8 @@ static int gup_fast_fallback(unsigned long start, unsigned long nr_pages, might_lock_read(¤t->mm->mmap_lock); start = untagged_addr(start) & PAGE_MASK; - len = nr_pages << PAGE_SHIFT; - if (check_add_overflow(start, len, &end)) + if (check_shl_overflow(nr_pages, PAGE_SHIFT, &len) || + check_add_overflow(start, len, &end)) return -EOVERFLOW; if (end > TASK_SIZE_MAX) return -EFAULT;