[PATCH 22/46] mm/gup: check for overflow when converting nr_pages to bytes in GUP-fast

[sashiko-bot at kernel.org]

> The overflow check in gup_fast_fallback() only covers the addition to
> start. The preceding nr_pages << PAGE_SHIFT can already have truncated
> the length on 32bit.
> 
> Users such as RapidIO's rio_dma_transfer() can derive such page counts
> from a 64-bit userspace length.
> 
> Let's just check_shl_overflow() to reject any such overflow with
> -EOVERFLOW early.
> 
> Fixes: c28b1fc70390 ("mm/gup: reorganize internal_get_user_pages_fast()")
> Cc: stable at vger.kernel.org
> Signed-off-by: David Hildenbrand (Arm) <david at kernel.org>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261027-fixes_core-v1-0-6f74bec9a5bb@kernel.org?part=22