Re: [PATCH] mm/memtest: prevent arithmetic underflow in end pointer calculation

[Kevin Lourenco <klourencodev@gmail.com>]

Hi Mike,

> Is it exactly ~0?

Not exactly - it's UINT64_MAX - (offset - size), but since offset
is at most 7 bytes (from ALIGN), the result is in the range
[~0 - 7, ~0], which after division by 8 still yields ~2^61 iterations.

Either way, if it happens, it's not great, WARN_ON_ONCE usage sounds
good, I'll send a v2 patch.

Thanks for the feedback!

Le dim. 28 déc. 2025 à 20:56, Mike Rapoport <rppt@kernel.org> a écrit :
>
> On Sat, Dec 20, 2025 at 04:10:19PM +0100, klourencodev@gmail.com wrote:
> > From: Kevin Lourenco <klourencodev@gmail.com>
> >
> > The computation of the loop end pointer can underflow when size is
> > smaller than the alignment offset:
> >
> >     (size - (start_phys_aligned - start_phys))
> >
> > If size < offset, the unsigned subtraction wraps to ~0, causing a
>
> Is it exactly ~0?
>
> > massive loop iteration that writes far beyond the intended region,
> > leading to memory corruption during early boot.
> >
> > While unlikely in practice (memblock regions are typically KB/MB), cost is negligible
> > (one comparison), but it prevents catastrophic memory corruption in
> > edge cases.
> >
> > Signed-off-by: Kevin Lourenco <klourencodev@gmail.com>
> > ---
> >  mm/memtest.c | 9 +++++++--
> >  1 file changed, 7 insertions(+), 2 deletions(-)
> >
> > diff --git a/mm/memtest.c b/mm/memtest.c
> > index c2c609c39119..d86c41f1c189 100644
> > --- a/mm/memtest.c
> > +++ b/mm/memtest.c
> > @@ -41,12 +41,17 @@ static void __init memtest(u64 pattern, phys_addr_t start_phys, phys_addr_t size
> >  {
> >       u64 *p, *start, *end;
> >       phys_addr_t start_bad, last_bad;
> > -     phys_addr_t start_phys_aligned;
> > +     phys_addr_t start_phys_aligned, offset;
> >       const size_t incr = sizeof(pattern);
> >
> >       start_phys_aligned = ALIGN(start_phys, incr);
> >       start = __va(start_phys_aligned);
> > -     end = start + (size - (start_phys_aligned - start_phys)) / incr;
>
> I believe VM_WARN_ON_ONCE(size < start_phys_aligned - start_phys) is
> sufficient here to detect those theoretical edge cases.
>
> > +
> > +     offset = start_phys_aligned - start_phys;
> > +     if (size < offset)
> > +             return;
> > +
> > +     end = start + (size - offset) / incr;
> >       start_bad = 0;
> >       last_bad = 0;
> >
> > --
> > 2.47.3
> >
>
> --
> Sincerely yours,
> Mike.