From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 978153A1E81 for ; Thu, 11 Jun 2026 12:32:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781181175; cv=none; b=iShwkJ6obao1iMrhT+yuvZs8IY+DsfR9B8v9P32CWMx2pP4hIsvirMyhSVnAIIfrXHYEJOt7enR0GJxxttAdztc2jje/pNdrzIJnT/r8eVjRfjA9r111XaEr9syT/fi0Wv2A4VAeOuL8X6oTNg1mOkiaG/vss8KWRZtglr6eE5w= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781181175; c=relaxed/simple; bh=RpHIMAYEgfzaNLGamiml8z4Fzqx3EibgMCFfAROW+R4=; h=From:To:Cc:Subject:In-Reply-To:References:Date:Message-ID: MIME-Version:Content-Type; b=OboAmHUa6xoQRagSozve9wF3hDlYeJJAFk1wKGypV27JirDR3lyQbq7vnefEllRnlj2VFf4uy9i02iyGMWeomnEIaVIRKyn5rNzEpoDvI39vTFW52WpQKok8EaDSk5BPv8KQUkZRKwwyDvgL/y4pcv0VruerpaWsYD9KrkMZ1rU= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=ePztP8aQ; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="ePztP8aQ" Received: by smtp.kernel.org (Postfix) with ESMTPSA id D76BE1F00893; Thu, 11 Jun 2026 12:32:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1781181174; bh=vpDuoAAfa3pi6DaCEs/tUqazlgd1kzXI4h/l0xgipiI=; h=From:To:Cc:Subject:In-Reply-To:References:Date; b=ePztP8aQhD2iLU3urqNcWGSwX3LpkF6rDc5L4zwTynmBf8maf3O1jDhc9T2Hl6aCQ wJeqvdwRwOGR1nRwV5rCfkNQUnOeheZh/5zLWxpMKjDuM8IcRl6sQdY30vmH3jJJaq 2tNn3QQoBPdmZdBsrngGJQnz+4XGzEZZzRV9Q3oKpd4qY7DivuReOLF5iYF4ML3aJI e1ZzDmsZ9ywQ1rvhNd5bTcWFLky8KneWSf3DS/2r2C5i46O6n1/hHV9cmT4wqQ6F8f /ENsCgKF8rVTRl2lJEFm3wKeDFZI9hZKV4vbY3U3TaUWYbcwM/wQjtE3ZjeAK/Bj2T HOE619OPLA9Uw== From: Pratyush Yadav To: Tarun Sahu Cc: Pasha Tatashin , Mike Rapoport , Pratyush Yadav , Andrew Morton , linux-kernel@vger.kernel.org, kexec@lists.infradead.org, linux-mm@kvack.org Subject: Re: [PATCH] mm/memfd_luo: validate serialized_data before conversion In-Reply-To: (Tarun Sahu's message of "Thu, 11 Jun 2026 10:30:03 +0000") References: Date: Thu, 11 Jun 2026 14:32:51 +0200 Message-ID: <2vxzv7bpqmto.fsf@kernel.org> User-Agent: Gnus/5.13 (Gnus v5.13) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain On Thu, Jun 11 2026, Tarun Sahu wrote: > In memfd_luo_finish() and memfd_luo_retrieve(), phys_to_virt() was called > on args->serialized_data before checking if the physical address is valid. > Since physical address 0 does not map to virtual NULL (due to direct Nit: this is only true on ARM64. On x86 physical address of 0 maps to NULL. Other than this, Reviewed-by: Pratyush Yadav (Google) > mapping offsets), the subsequent check 'if (!ser)' was ineffective at > catching a missing serialized_data, leading to unsafe dereferences later. > > Validate that args->serialized_data is non-zero before calling > phys_to_virt(). > > Fixes: b3749f174d68 ("mm: memfd_luo: allow preserving memfd") > Signed-off-by: Tarun Sahu [...] -- Regards, Pratyush Yadav