Re: drivers/xen/gntdev.c:817 gntdev_get_page() warn: mask and shift to zero: expr='(addr & ~(~((1 << 12) - 1))) >> 12'

[Arnd Bergmann]

On Thu, Sep 24, 2026, at 21:39, Dan Carpenter wrote:

>    489                          return -EFAULT;
>    490                  break;
>    491          case 2:
>    492                  if (copy_from_user(&m, udata, sizeof(struct 
> privcmd_mmapbatch_v2)))
>    493                          return -EFAULT;
>    494                  /* Returns per-frame error code in m.err. */
>    495                  if (!access_ok(m.err, m.num * (sizeof(*m.err))))
>                                               ^^^^^^^^^^^^^^^^^^^^^^^
> These integer overflow bugs are from 2012, but I guess your patch 
> exposed
> the arm32 build to the zero day bot.  The bugs only affect 32bit 
> systems.

Right, the randconfig came up with an ARMv6 Xen build, which was not
possible before my patch. I'm sure this was reported for other configs
before and just showed up as introduced by my patch here.

This is clearly a bug but it does look harmless to me, as it only
results in the userspace corrupting itself when passing invalid
data.

      Arnd