drivers/xen/gntdev.c:817 gntdev_get_page() warn: mask and shift to zero: expr='(addr & ~(~((1 << 12) - 1))) >> 12'

[Dan Carpenter]

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head:   62f4c998b297cf233997a2b4cd6fc2d2df0319c9
commit: d70242427110123b65c095594eb74a703d3af156 ARM: rework ARM11 CPU selection logic
config: arm-randconfig-r2200-20260924 (https://download.01.org/0day-ci/archive/20260924/202609241805.VsLzGPLn-lkp@xxxxxxxxx/config)
compiler: arm-linux-gnueabi-gcc (GCC) 10.5.0
smatch: v0.5.0-9187-g5189e3fb

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Fixes: d70242427110 ("ARM: rework ARM11 CPU selection logic")
| Reported-by: kernel test robot <lkp@xxxxxxxxx>
| Reported-by: Dan Carpenter <error27@xxxxxxxxx>
| Closes: https://lore.kernel.org/r/202609241805.VsLzGPLn-lkp@xxxxxxxxx/

smatch warnings:
drivers/xen/privcmd.c:488 privcmd_ioctl_mmap_batch() warn: potential user controlled sizeof overflow 'm.num * 8' '0-u32max * 8'
drivers/xen/privcmd.c:495 privcmd_ioctl_mmap_batch() warn: potential user controlled sizeof overflow 'm.num * (4)' '0-u32max * 4'

vim +817 drivers/xen/gntdev.c
   470  static long privcmd_ioctl_mmap_batch(
   471          struct file *file, void __user *udata, int version)
   472  {
   473          struct privcmd_data *data = file->private_data;
   474          int ret;
   475          struct privcmd_mmapbatch_v2 m;
   476          struct mm_struct *mm = current->mm;
   477          struct vm_area_struct *vma;
   478          unsigned long nr_pages;
   479          LIST_HEAD(pagelist);
   480          struct mmap_batch_state state;
   481  
   482          switch (version) {
   483          case 1:
   484                  if (copy_from_user(&m, udata, sizeof(struct privcmd_mmapbatch)))
   485                          return -EFAULT;
   486                  /* Returns per-frame error in m.arr. */
   487                  m.err = NULL;
   488                  if (!access_ok(m.arr, m.num * sizeof(*m.arr)))
                                              ^^^^^^^^^^^^^^^^^^^^^^

   489                          return -EFAULT;
   490                  break;
   491          case 2:
   492                  if (copy_from_user(&m, udata, sizeof(struct privcmd_mmapbatch_v2)))
   493                          return -EFAULT;
   494                  /* Returns per-frame error code in m.err. */
   495                  if (!access_ok(m.err, m.num * (sizeof(*m.err))))
                                              ^^^^^^^^^^^^^^^^^^^^^^^
These integer overflow bugs are from 2012, but I guess your patch exposed
the arm32 build to the zero day bot.  The bugs only affect 32bit systems.

   496                          return -EFAULT;
   497                  break;
   498          default:
   499                  return -EINVAL;
   500          }
   501  
   502          /* If restriction is in place, check the domid matches */
   503          if (data->domid != DOMID_INVALID && data->domid != m.dom)
   504                  return -EPERM;
   505  


--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki