> From: Jason Gunthorpe <jgg@xxxxxxxxxx> > Sent: Friday, May 16, 2025 12:47 AM > > On Thu, May 08, 2025 at 08:02:35PM -0700, Nicolin Chen wrote: > > + /* vma->vm_pgoff carries an index to an mtree entry (immap) */ > > + immap = mtree_load(&ictx->mt_mmap, vma->vm_pgoff); > > + if (!immap) > > + return -ENXIO; > > + if (length >> PAGE_SHIFT != immap->num_pfns) > > + return -ENXIO; > > This needs to validate that vm_pgoff is at the start of the immap or > num_pfns is the wrong thing to validate length against. > vm_pgoff is the index into mtree. If it's wrong mtree_load() will fail already?
