From nobody Tue Dec 16 13:27:26 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1D9A3E7AD58 for ; Tue, 3 Oct 2023 14:49:06 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240162AbjJCOtH (ORCPT ); Tue, 3 Oct 2023 10:49:07 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:32862 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229539AbjJCOtF (ORCPT ); Tue, 3 Oct 2023 10:49:05 -0400 Received: from mail-oo1-xc41.google.com (mail-oo1-xc41.google.com [IPv6:2607:f8b0:4864:20::c41]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9417EAB for ; Tue, 3 Oct 2023 07:49:02 -0700 (PDT) Received: by mail-oo1-xc41.google.com with SMTP id 006d021491bc7-57bbb38d5d4so548306eaf.2 for ; Tue, 03 Oct 2023 07:49:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1696344542; x=1696949342; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=+b4EtjPouuLro3RPQ2u+6EnaEB6T6SR+sicsyHJKMSU=; b=U4PDonQhm/9gDByRCTsOOTTZ0G+YEQoTmYEA1FyAC+wWrcE8ReraJuzc+bnyTLhND3 TddJNk1AYhdIuPlw3UIv+K9GyrVrx5XSgEbM39azTe5tzTrh2Rr/Y2PwL775pCDoCkju zPtbOQLluij/8nP9gCByxfzSGC9l7qvTIavmGmSjuZFkHrOOE/p/MvqRXhsHVoqtcXkA YqsYRL8t9q+H+gpMl2bsGFCruwV/PndG7AB3ZfAp2uW6bB9vqpzaitByQh142aXRk2cP Um5nMM0jmjou5VDGvHXJzPiphvOY1Ydrz3unZ+Hs9sqfUBiVVWWhn4mWcKOAOTJhLaea R3gw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1696344542; x=1696949342; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=+b4EtjPouuLro3RPQ2u+6EnaEB6T6SR+sicsyHJKMSU=; b=O0E2gJe1/x7IFqhlGCnvHuUPopF9TMxrF/CL4T6NTBof95xE8nYMwIdc7RjOnzUr9H Bt4Ah3EaCW3g091IA7CRELI/cBMKOeT0EO2zOcuZTy41xoRDDZNx6lGSU0lmBjmVjk/b I7+qO3WKWlz0g0/GOa1FHqVpmjkKLwkPr7OrH9SpOaPcjzTp+Pl40gX3BSgeuYwe9UDX k/cKhEpUQt/kvd5jHozQy18KrMXuw/7/v9in3toCBGRTwc0NSN4d2hFzLloL8Owezh0V +fPywylZ0uC8wKoydx/jGrlce35DMkz4SrWqw21YMYZc5sZFxYoea1yzo4QUC9pe9c/H fMcA== X-Gm-Message-State: AOJu0YzTCq1Fw3o23c64+X8J86f1g58zwCdpBzZbqnPFO+zyiOtQIHYc a/cFBmnmlOkEl58msnuk/88C6DdGcRgeALA= X-Google-Smtp-Source: AGHT+IHwXZ8gHdJJX/lcyMp5I8mG80fjmHLetl/aHXgjiax+vDvRmpwELVC+UPeAF0qyrj2dvvoYyg== X-Received: by 2002:a4a:d21d:0:b0:57b:469d:8af6 with SMTP id c29-20020a4ad21d000000b0057b469d8af6mr12475644oos.4.1696344541655; Tue, 03 Oct 2023 07:49:01 -0700 (PDT) Received: from fedora.mshome.net (pool-173-79-56-208.washdc.fios.verizon.net. [173.79.56.208]) by smtp.gmail.com with ESMTPSA id d137-20020a4a528f000000b0057de3e449c8sm228889oob.8.2023.10.03.07.49.00 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 03 Oct 2023 07:49:01 -0700 (PDT) From: Gregory Price X-Google-Original-From: Gregory Price To: linux-mm@kvack.org Cc: linux-kernel@vger.kernel.org, arnd@arndb.de, akpm@linux-foundation.org, Gregory Price Subject: [PATCH] mm/migrate: fix do_pages_move for compat pointers Date: Tue, 3 Oct 2023 10:48:56 -0400 Message-Id: <20231003144857.752952-1-gregory.price@memverge.com> X-Mailer: git-send-email 2.39.1 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" do_pages_move does not handle compat pointers for the page list. correctly. Add in_compat_syscall check and appropriate get_user fetch when iterating the page list. Fixes: 5b1b561ba73c ("mm: simplify compat_sys_move_pages") Signed-off-by: Gregory Price Reported-by: Arnd Bergmann Co-developed-by: Arnd Bergmann --- mm/migrate.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/mm/migrate.c b/mm/migrate.c index 2053b54556ca..06086dc9da28 100644 --- a/mm/migrate.c +++ b/mm/migrate.c @@ -2162,6 +2162,7 @@ static int do_pages_move(struct mm_struct *mm, nodema= sk_t task_nodes, const int __user *nodes, int __user *status, int flags) { + compat_uptr_t __user *compat_pages =3D (void __user *)pages; int current_node =3D NUMA_NO_NODE; LIST_HEAD(pagelist); int start, i; @@ -2174,8 +2175,17 @@ static int do_pages_move(struct mm_struct *mm, nodem= ask_t task_nodes, int node; =20 err =3D -EFAULT; - if (get_user(p, pages + i)) - goto out_flush; + if (in_compat_syscall()) { + compat_uptr_t cp; + + if (get_user(cp, compat_pages + i)) + goto out_flush; + + p =3D compat_ptr(cp); + } else { + if (get_user(p, pages + i)) + goto out_flush; + } if (get_user(node, nodes + i)) goto out_flush; =20 --=20 2.39.1