Linux-mm Archive on lore.kernel.org
 help / color / mirror / Atom feed
From: Muchun Song <muchun.song@linux.dev>
To: David Carlier <devnexen@gmail.com>
Cc: Andrew Morton <akpm@linux-foundation.org>,
	Dave Chinner <david@fromorbit.com>, Qi Zheng <qi.zheng@linux.dev>,
	Roman Gushchin <roman.gushchin@linux.dev>,
	linux-mm@kvack.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH] mm/shrinker: avoid out-of-bounds read in set_shrinker_bit()
Date: Mon, 11 May 2026 10:48:41 +0800	[thread overview]
Message-ID: <3E00B1F3-9C41-4E41-892B-81BE19C3757C@linux.dev> (raw)
In-Reply-To: <20260510183700.102475-1-devnexen@gmail.com>



> On May 11, 2026, at 02:37, David Carlier <devnexen@gmail.com> wrote:
> 
> set_shrinker_bit() reads info->unit[shrinker_id_to_index(shrinker_id)]
> before checking shrinker_id against info->map_nr_max, so an id past the
> currently visible map_nr_max reads past the unit[] array before the
> WARN_ON_ONCE() catches it.
> 
> Move the load into the bounded branch.
> 
> Fixes: 307bececcd12 ("mm: shrinker: add a secondary array for shrinker_info::{map, nr_deferred}")
> Signed-off-by: David Carlier <devnexen@gmail.com>

Acked-by: Muchun Song <muchun.song@linux.dev>

Thanks.



      parent reply	other threads:[~2026-05-11  2:49 UTC|newest]

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-05-10 18:37 [PATCH] mm/shrinker: avoid out-of-bounds read in set_shrinker_bit() David Carlier
2026-05-11  2:45 ` Qi Zheng
2026-05-11  2:46   ` David CARLIER
2026-05-11  2:48 ` Muchun Song [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=3E00B1F3-9C41-4E41-892B-81BE19C3757C@linux.dev \
    --to=muchun.song@linux.dev \
    --cc=akpm@linux-foundation.org \
    --cc=david@fromorbit.com \
    --cc=devnexen@gmail.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-mm@kvack.org \
    --cc=qi.zheng@linux.dev \
    --cc=roman.gushchin@linux.dev \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox