From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-vk1-f178.google.com (mail-vk1-f178.google.com [209.85.221.178]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1CF713C13F6 for ; Thu, 2 Apr 2026 12:55:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.178 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775134531; cv=none; b=e6rW2xAPz/pdoPWvEP79en03J1pClGp/o07GQrYDhR7g4AVo3Bfp29V8xVJzdfoq/TzbI9tg07oCAZrRhs9WuRo9NtgSksrmY2YCHa+J5QMlJv3H8eLm7FktJxyipPzPXq7oRcou6m0yugWBzOg4gpwmQN/AFpqa2j4+OKDLoVk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775134531; c=relaxed/simple; bh=9MtKRQ5M+bp1zJOU/8ASwu4KWEN9j9lDStP99duruKo=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=kdU4csFj5EjXJMSFIpgldbU4CTDWEtUIPllM9c4d+L0783OuHaxUnc0//w1kLhE0Flxqcr8Xf+gaXUV7IDhAzAQa6RA/3SO+fa0niUBnOJ+z6lygS1ObYH1nnj3wip9bz6m2yqS4CsWNTJ2AR0ix7cbyCdwt0sQ2oQXENSbfwzk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=l+Mp+FfI; arc=none smtp.client-ip=209.85.221.178 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="l+Mp+FfI" Received: by mail-vk1-f178.google.com with SMTP id 71dfb90a1353d-56d357797acso621603e0c.1 for ; Thu, 02 Apr 2026 05:55:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1775134522; x=1775739322; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=/piubItRaGyzWs9BDYPbrLc9Q9XuMH2IjUibk3CFdsU=; b=l+Mp+FfIjAzf9veLnpDZw5pColg24jqp0rApYmmqC3RyH1mkhnYs7YvXFA3Z/RIYIi KBFzwT+FjI1JuK+DRG8uh6mCJC8j4i6icFofsOYJbKhc/zITX3Aio9bAcHw3Cvex75gV dMHfzSJw+GuuuN51ezGdKK4jLRiVpeaDIiVZV7ZZgE6+kL15jrkNqWmZ7j2SzbIWOCh0 Mg7qEFemQg7PgvnicFpeb4PpWooc1nKQk9StyvBYG5Z57tHi7LG06Cw2s3CoMX/40I29 UDAdSfgsaMs4fk1LHIh6KMxulXqsIx7lv1B9ucA2hG3waMnWilHwZh+HNECZfWrbzeLC DHnw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1775134522; x=1775739322; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=/piubItRaGyzWs9BDYPbrLc9Q9XuMH2IjUibk3CFdsU=; b=EZZ/ShSSan9N8d3rj1UsQWKd6TN//Xv1Npm1vdY2XHS5ikjUCqaUQmpP2MkAjr3qup KwqWkTM7rCHi5eZah73bTCRObYgawVkN15fnYUzJHuC5DTqGZ/f7V1kwqmL3waBAOR2i avQEsHD9DYIE/+Ku7XgzuWt8Bwo/eUAxyLmhBBBFzhxRqh23C5cMmYClc9sl9V3KtN6C sDha0Gy005oP/3VMNbIaIuosZzBVt+gLSmB+hteB8cM5jXsyMtUfh0cSSNdJ4Ayd7Dn5 2uAlgAXezLhJjBOmPHQPvJrSLw9jcGtu9GLDZwXcuDnlBWwVEnxRrDkKOihNtX82f+lE Hs5w== X-Forwarded-Encrypted: i=1; AJvYcCUuWW4AtLd2QJc/BPMa2ce8393WQvAw5KX7SztNYi+Aj96A8cPWJSU5UqR7KMkbP2FiNWZZKkDlAj5Ak4g=@vger.kernel.org X-Gm-Message-State: AOJu0YwBtSCrUmi9GVbgKsE4KjzkHr6ZSoDbB5j+3MHkfUKxBBd1+v4M DeWyeartpw5jdhCE891k0L07Hx7/EIdNwbW+2L2++YF2PMyD1z1pMi1Vy46vMJlG/DeKMrRM X-Gm-Gg: ATEYQzxW99enU80Ow6JZamN6B3WoT3iuyy3NOOkLzGE6Zm85F9ucjgfPBJFSWH68/Dh /h8KoNDfXQwzZ1HrCvzXNFvrGvDGkXwNZydsUPHnGFW5c+jqVB/Kg1F92UWUFoD8MoyPx1N0H51 bW5cu5AxXwhBe/5xTeKsb3rhnU8fsmlm2/ESaACrNY23zc4OMUHcQmYIrEn29PTjzHhBz/sL+6F OS/H3yO7wB2B+gkTreqaSeuw2wUAq29rDDVkrP0zYHDlpLyw1/swx0Qgxwt0agreG6HsnKzWjyq WOSLjKRkB8mg/iFptZ11aYH8Rt1+GWAyOVY6DMsSap3wEDiZCw5QGd9xNveHcsxU4volS3CEbeX s1+6lt7Du7955/8Y9ndn/NFO/wU7QTiC2iX6EigjNcCjxWpxfm7wuFzTZ0Mw3gx0zxUtPTZXmu8 mL9dKnvVd3E8s2169zVtzMsFQ= X-Received: by 2002:a05:6122:e462:b0:566:4689:46eb with SMTP id 71dfb90a1353d-56d8a658429mr3295957e0c.0.1775134521759; Thu, 02 Apr 2026 05:55:21 -0700 (PDT) Received: from localhost.localdomain ([2a09:bac5:6d73:aa::11:178]) by smtp.gmail.com with ESMTPSA id a1e0cc1a2514c-953fba6af44sm3080950241.8.2026.04.02.05.55.20 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 02 Apr 2026 05:55:21 -0700 (PDT) From: Sebastian Alba Vives To: linux-fpga@vger.kernel.org Cc: yilun.xu@linux.intel.com, conor.dooley@microchip.com, mdf@kernel.org, linux-kernel@vger.kernel.org, Sebastian Josue Alba Vives Subject: [PATCH 2/3] fpga: dfl-afu: fix integer truncation of npages in afu_dma_pin_pages() Date: Thu, 2 Apr 2026 06:54:45 -0600 Message-ID: <20260402125446.3776153-2-sebasjosue84@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260402125446.3776153-1-sebasjosue84@gmail.com> References: <20260402125446.3776153-1-sebasjosue84@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Sebastian Josue Alba Vives In afu_dma_pin_pages(), npages is declared as int but is assigned from region->length >> PAGE_SHIFT where region->length is u64. This causes implicit truncation on 64-bit systems when length is large. The truncated value is then passed to account_locked_vm() (which takes unsigned long) with implicit sign extension, and to pin_user_pages_fast() which takes int nr_pages, potentially causing incorrect VM accounting. Change npages to unsigned long and add a cap to prevent values exceeding INT_MAX from reaching pin_user_pages_fast(). Signed-off-by: Sebastian Alba Vives --- drivers/fpga/dfl-afu-dma-region.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/fpga/dfl-afu-dma-region.c b/drivers/fpga/dfl-afu-dma-region.c index 87652d5..0d1f973 100644 --- a/drivers/fpga/dfl-afu-dma-region.c +++ b/drivers/fpga/dfl-afu-dma-region.c @@ -34,10 +34,13 @@ void afu_dma_region_init(struct dfl_feature_dev_data *fdata) static int afu_dma_pin_pages(struct dfl_feature_dev_data *fdata, struct dfl_afu_dma_region *region) { - int npages = region->length >> PAGE_SHIFT; + unsigned long npages = region->length >> PAGE_SHIFT; struct device *dev = &fdata->dev->dev; int ret, pinned; + if (npages > INT_MAX) + return -EINVAL; + ret = account_locked_vm(current->mm, npages, true); if (ret) return ret; -- 2.43.0