[PATCH] Fix do_pages_stat to use compat_uptr_t

[Christoph Berg <myon@debian.org>]

[-- Attachment #1: Type: text/plain, Size: 663 bytes --]

Hi,

PostgreSQL 18 will feature NUMA introspection of its shared memory
structures. The regression tests for this are failing on Debian's
32-bit architectures which are nowadays all built on 64-bit hosts
(i386, armel, armhf, x32).

Bertrand Drouvot analyzed the issue to be in do_pages_stat:

https://www.postgresql.org/message-id/flat/a3a4fe3d-1a80-4e03-aa8e-150ee15f6c35%40vondra.me#6abe7eaa802b5b07bb70cc3229e63a9f

do_pages_stat() is already handling the input arrays correctly in
32-bit mode, but at the end of the "while (nr_pages)" loop, it
incorrectly advances the pages pointer with the wrong word size.

The attached patch fixes the problem.

Christoph

[-- Attachment #2: 0001-Fix-do_pages_stat-to-use-compat_uptr_t.patch --]
[-- Type: text/x-diff, Size: 1060 bytes --]

From 70225fb0be382c3fd443e8331688b88d0e52c04c Mon Sep 17 00:00:00 2001
From: Christoph Berg <myon@debian.org>
Date: Tue, 24 Jun 2025 16:44:27 +0200
Subject: [PATCH] Fix do_pages_stat to use compat_uptr_t

For arrays with more than 16 entries, the old code would incorrectly
advance the pages pointer by 16 words instead of 16 compat_uptr_t.

Signed-off-by: Christoph Berg <myon@debian.org>
---
 mm/migrate.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/mm/migrate.c b/mm/migrate.c
index 8cf0f9c9599..542c81ec3ed 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -2444,7 +2444,13 @@ static int do_pages_stat(struct mm_struct *mm, unsigned long nr_pages,
 		if (copy_to_user(status, chunk_status, chunk_nr * sizeof(*status)))
 			break;
 
-		pages += chunk_nr;
+		if (in_compat_syscall()) {
+			compat_uptr_t __user *pages32 = (compat_uptr_t __user *)pages;
+
+			pages32 += chunk_nr;
+			pages = (const void __user * __user *) pages32;
+		} else
+			pages += chunk_nr;
 		status += chunk_nr;
 		nr_pages -= chunk_nr;
 	}
-- 
2.47.2