On 3/20/26 23:39, Lorenzo Stoakes (Oracle) wrote: > Now we have range_in_vma_desc(), update remap_pfn_range_prepare() to check > whether the input range in contained within the specified VMA, so we can > fail at prepare time if an invalid range is specified. > > This covers the I/O remap mmap actions also which ultimately call into > this function, and other mmap action types either already span the full > VMA or check this already. > > Reviewed-by: Suren Baghdasaryan <[email protected]> > Signed-off-by: Lorenzo Stoakes (Oracle) <[email protected]>
Acked-by: Vlastimil Babka (SUSE) <[email protected]> > --- > mm/memory.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/mm/memory.c b/mm/memory.c > index 53ef8ef3d04a..68cc592ff0ba 100644 > --- a/mm/memory.c > +++ b/mm/memory.c > @@ -3142,6 +3142,9 @@ int remap_pfn_range_prepare(struct vm_area_desc *desc) > const bool is_cow = vma_desc_is_cow_mapping(desc); > int err; > > + if (!range_in_vma_desc(desc, start, end)) > + return -EFAULT; > + > err = get_remap_pgoff(is_cow, start, end, desc->start, desc->end, pfn, > &desc->pgoff); > if (err)
