From nobody Tue Apr 28 10:28:06 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4FA35C433F5 for ; Wed, 1 Jun 2022 09:33:05 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1351112AbiFAJdE (ORCPT ); Wed, 1 Jun 2022 05:33:04 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48226 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345378AbiFAJc7 (ORCPT ); Wed, 1 Jun 2022 05:32:59 -0400 Received: from foss.arm.com (foss.arm.com [217.140.110.172]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id 8F0EC8AE42 for ; Wed, 1 Jun 2022 02:32:58 -0700 (PDT) Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 5C1F223A; Wed, 1 Jun 2022 02:32:58 -0700 (PDT) Received: from net-x86-dell-8268.shanghai.arm.com (net-x86-dell-8268.shanghai.arm.com [10.169.210.133]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPA id 3F2223F66F; Wed, 1 Jun 2022 02:32:56 -0700 (PDT) From: Tianyu Li To: Andrew Morton , Arnd Bergmann , linux-mm@kvack.org (open list:MEMORY MANAGEMENT), linux-kernel@vger.kernel.org (open list) Cc: nd@arm.com, Tianyu Li Subject: [PATCH] mm/mempolicy: fix get_nodes out of bound access Date: Wed, 1 Jun 2022 17:32:11 +0800 Message-Id: <20220601093211.2970565-1-tianyu.li@arm.com> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" When user specified more nodes than supported, get_nodes will access nmask array out of bound. Fixes: e130242dc351 ("mm: simplify compat numa syscalls") Signed-off-by: Tianyu Li --- mm/mempolicy.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mm/mempolicy.c b/mm/mempolicy.c index 0b4ba3ee810e..9f27dc4b66ba 100644 --- a/mm/mempolicy.c +++ b/mm/mempolicy.c @@ -1388,7 +1388,7 @@ static int get_nodes(nodemask_t *nodes, const unsigne= d long __user *nmask, unsigned long bits =3D min_t(unsigned long, maxnode, BITS_PER_LONG); unsigned long t; =20 - if (get_bitmap(&t, &nmask[maxnode / BITS_PER_LONG], bits)) + if (get_bitmap(&t, &nmask[(maxnode - 1) / BITS_PER_LONG], bits)) return -EFAULT; =20 if (maxnode - bits >=3D MAX_NUMNODES) { --=20 2.25.1