Re: [PATCH] mm/memtest: prevent arithmetic underflow in end pointer calculation

[Mike Rapoport <rppt@kernel.org>]

On Sat, Dec 20, 2025 at 04:10:19PM +0100, klourencodev@gmail.com wrote:
> From: Kevin Lourenco <klourencodev@gmail.com>
> 
> The computation of the loop end pointer can underflow when size is
> smaller than the alignment offset:
> 
>     (size - (start_phys_aligned - start_phys))
> 
> If size < offset, the unsigned subtraction wraps to ~0, causing a

Is it exactly ~0?  

> massive loop iteration that writes far beyond the intended region,
> leading to memory corruption during early boot.
> 
> While unlikely in practice (memblock regions are typically KB/MB), cost is negligible
> (one comparison), but it prevents catastrophic memory corruption in
> edge cases.
>
> Signed-off-by: Kevin Lourenco <klourencodev@gmail.com>
> ---
>  mm/memtest.c | 9 +++++++--
>  1 file changed, 7 insertions(+), 2 deletions(-)
> 
> diff --git a/mm/memtest.c b/mm/memtest.c
> index c2c609c39119..d86c41f1c189 100644
> --- a/mm/memtest.c
> +++ b/mm/memtest.c
> @@ -41,12 +41,17 @@ static void __init memtest(u64 pattern, phys_addr_t start_phys, phys_addr_t size
>  {
>  	u64 *p, *start, *end;
>  	phys_addr_t start_bad, last_bad;
> -	phys_addr_t start_phys_aligned;
> +	phys_addr_t start_phys_aligned, offset;
>  	const size_t incr = sizeof(pattern);
>  
>  	start_phys_aligned = ALIGN(start_phys, incr);
>  	start = __va(start_phys_aligned);
> -	end = start + (size - (start_phys_aligned - start_phys)) / incr;

I believe VM_WARN_ON_ONCE(size < start_phys_aligned - start_phys) is
sufficient here to detect those theoretical edge cases.

> +	
> +	offset = start_phys_aligned - start_phys;
> +	if (size < offset)
> +		return;
> +
> +	end = start + (size - offset) / incr;
>  	start_bad = 0;
>  	last_bad = 0;
>  
> -- 
> 2.47.3
> 

-- 
Sincerely yours,
Mike.