[PATCH v3 0/2] mm/gup_test: prevent overflow and report actual pinned bytes

[PATCH v3 0/2] mm/gup_test: prevent overflow and report actual pinned bytes

[Sarthak Sharma]

__gup_test_ioctl() accepts the number of pages per call from userspace. Its
batch end calculation can overflow and wrap around, bypassing the existing
check. This can cause GUP to write beyond the allocated pages array. This
issue was reported by Sashiko.

Also, gup->size is calculated from address difference instead of the actual
pages pinned. This can report partial pages pinned as covering the whole
requested range.

Prevent overflow by clamping each batch before calculating next and
report the actual bytes pinned.

Changes in v3:
- Add a new patch to prevent overflow in GUP batch calculation

Changes in v2:
- Fix a typo in the commit message

Previous versions:
v2: https://lore.kernel.org/all/20260831101304.162867-1-sarthak.sharma@arm.com/
v1: https://lore.kernel.org/all/20260831064808.77768-1-sarthak.sharma@arm.com/

Sarthak Sharma (2):
  mm/gup_test: prevent overflow in GUP batch calculation
  mm/gup_test: report actual pinned bytes

 mm/gup_test.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

-- 
2.53.0

[PATCH v3 1/2] mm/gup_test: prevent overflow in GUP batch calculation

[Sarthak Sharma]

__gup_test_ioctl() calculates the end of a GUP batch using:

next = addr + nr * PAGE_SIZE;

If nr is too large, it can cause the next to overflow and wrap around.
If it wraps, the next > end check is bypassed and a large value
of nr is passed to the gup call, even though the pages array was
allocated according to gup->size. This can lead to out of bounds writes.

Compare nr with the number of pages remaining before performing
the multiplication. Clamp it to remaining range so that next does
not overflow or exceed end.

Fixes: 64c349f4ae78 ("mm: add infrastructure for get_user_pages_fast() benchmarking")
Signed-off-by: Sarthak Sharma <sarthak.sharma@arm.com>
---
 mm/gup_test.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/mm/gup_test.c b/mm/gup_test.c
index 44c1cdfb9c37..910cbef709b4 100644
--- a/mm/gup_test.c
+++ b/mm/gup_test.c
@@ -139,10 +139,11 @@ static int __gup_test_ioctl(unsigned int cmd,
 		if (nr != gup->nr_pages_per_call)
 			break;
 
-		next = addr + nr * PAGE_SIZE;
-		if (next > end) {
+		if (nr > (end - addr) / PAGE_SIZE) {
 			next = end;
 			nr = (next - addr) / PAGE_SIZE;
+		} else {
+			next = addr + nr * PAGE_SIZE;
 		}
 
 		switch (cmd) {
-- 
2.53.0

Re: [PATCH v3 1/2] mm/gup_test: prevent overflow in GUP batch calculation

[Kiryl Shutsemau]

On Tue, Sep 01, 2026 at 02:04:51PM +0530, Sarthak Sharma wrote:
> __gup_test_ioctl() calculates the end of a GUP batch using:
> 
> next = addr + nr * PAGE_SIZE;
> 
> If nr is too large, it can cause the next to overflow and wrap around.
> If it wraps, the next > end check is bypassed and a large value
> of nr is passed to the gup call, even though the pages array was
> allocated according to gup->size. This can lead to out of bounds writes.
> 
> Compare nr with the number of pages remaining before performing
> the multiplication. Clamp it to remaining range so that next does
> not overflow or exceed end.
> 
> Fixes: 64c349f4ae78 ("mm: add infrastructure for get_user_pages_fast() benchmarking")
> Signed-off-by: Sarthak Sharma <sarthak.sharma@arm.com>
> ---
>  mm/gup_test.c | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/mm/gup_test.c b/mm/gup_test.c
> index 44c1cdfb9c37..910cbef709b4 100644
> --- a/mm/gup_test.c
> +++ b/mm/gup_test.c
> @@ -139,10 +139,11 @@ static int __gup_test_ioctl(unsigned int cmd,
>  		if (nr != gup->nr_pages_per_call)
>  			break;
>  
> -		next = addr + nr * PAGE_SIZE;
> -		if (next > end) {
> +		if (nr > (end - addr) / PAGE_SIZE) {
>  			next = end;
>  			nr = (next - addr) / PAGE_SIZE;
> +		} else {
> +			next = addr + nr * PAGE_SIZE;
>  		}
>  
>  		switch (cmd) {

What about this:

              nr = min(nr, (end - addr) / PAGE_SIZE);
              next = addr + nr * PAGE_SIZE;

Seems to be easier to follow, no?

-- 
  Kiryl Shutsemau / Kirill A. Shutemov

Re: [PATCH v3 1/2] mm/gup_test: prevent overflow in GUP batch calculation

[Sarthak Sharma]

Hi Kiryl!

On 9/1/26 4:05 PM, Kiryl Shutsemau wrote:
> On Tue, Sep 01, 2026 at 02:04:51PM +0530, Sarthak Sharma wrote:
>> __gup_test_ioctl() calculates the end of a GUP batch using:
>>
>> next = addr + nr * PAGE_SIZE;
>>
>> If nr is too large, it can cause the next to overflow and wrap around.
>> If it wraps, the next > end check is bypassed and a large value
>> of nr is passed to the gup call, even though the pages array was
>> allocated according to gup->size. This can lead to out of bounds writes.
>>
>> Compare nr with the number of pages remaining before performing
>> the multiplication. Clamp it to remaining range so that next does
>> not overflow or exceed end.
>>
>> Fixes: 64c349f4ae78 ("mm: add infrastructure for get_user_pages_fast() benchmarking")
>> Signed-off-by: Sarthak Sharma <sarthak.sharma@arm.com>
>> ---
>>  mm/gup_test.c | 5 +++--
>>  1 file changed, 3 insertions(+), 2 deletions(-)
>>
>> diff --git a/mm/gup_test.c b/mm/gup_test.c
>> index 44c1cdfb9c37..910cbef709b4 100644
>> --- a/mm/gup_test.c
>> +++ b/mm/gup_test.c
>> @@ -139,10 +139,11 @@ static int __gup_test_ioctl(unsigned int cmd,
>>  		if (nr != gup->nr_pages_per_call)
>>  			break;
>>  
>> -		next = addr + nr * PAGE_SIZE;
>> -		if (next > end) {
>> +		if (nr > (end - addr) / PAGE_SIZE) {
>>  			next = end;
>>  			nr = (next - addr) / PAGE_SIZE;
>> +		} else {
>> +			next = addr + nr * PAGE_SIZE;
>>  		}
>>  
>>  		switch (cmd) {
> 
> What about this:
> 
>               nr = min(nr, (end - addr) / PAGE_SIZE);
>               next = addr + nr * PAGE_SIZE;
> 
> Seems to be easier to follow, no?

Yup, this would be cleaner. Do you want me to respin with this changed?

Re: [PATCH v3 1/2] mm/gup_test: prevent overflow in GUP batch calculation

[Kiryl Shutsemau]

On Tue, Sep 01, 2026 at 04:52:11PM +0530, Sarthak Sharma wrote:
> Hi Kiryl!
> 
> On 9/1/26 4:05 PM, Kiryl Shutsemau wrote:
> > On Tue, Sep 01, 2026 at 02:04:51PM +0530, Sarthak Sharma wrote:
> > What about this:
> > 
> >               nr = min(nr, (end - addr) / PAGE_SIZE);
> >               next = addr + nr * PAGE_SIZE;
> > 
> > Seems to be easier to follow, no?
> 
> Yup, this would be cleaner. Do you want me to respin with this changed?

Let's wait a bit for more feedback.

-- 
  Kiryl Shutsemau / Kirill A. Shutemov

[PATCH v3 2/2] mm/gup_test: report actual pinned bytes

[Sarthak Sharma]

__gup_test_ioctl() advances addr to the end of the current batch before
checking if GUP pinned the entire requested batch. If GUP pins more than
0 pages but less than the requested batch size, addr still advances by
the requested batch size.

The next iteration detects the partial pinning and breaks out of the loop.
Again gup->size is calculated using addr - gup->addr, so it also includes
the unpinned pages of the requested batch.

Calculate gup->size using the actual number of pages pinned multiplied
by PAGE_SIZE.

Fixes: 64c349f4ae78 ("mm: add infrastructure for get_user_pages_fast() benchmarking")
Reviewed-by: Kiryl Shutsemau (Meta) <kas@kernel.org>
Signed-off-by: Sarthak Sharma <sarthak.sharma@arm.com>
---
 mm/gup_test.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mm/gup_test.c b/mm/gup_test.c
index 910cbef709b4..b72f59a89c1c 100644
--- a/mm/gup_test.c
+++ b/mm/gup_test.c
@@ -189,7 +189,7 @@ static int __gup_test_ioctl(unsigned int cmd,
 	nr_pages = i;
 
 	gup->get_delta_usec = ktime_us_delta(end_time, start_time);
-	gup->size = addr - gup->addr;
+	gup->size = nr_pages * PAGE_SIZE;
 
 	/*
 	 * Take an un-benchmark-timed moment to verify DMA pinned
-- 
2.53.0