On Mon, Jan 18, 2021 at 11:30:03AM -0500, Douglas Gilbert wrote: > After several flawed attempts to detect overflow, take the fastest > route by stating as a pre-condition that the 'order' function argument > cannot exceed 16 (2^16 * 4k = 256 MiB). That doesn't help, the point of the overflow check is similar to overflow checks in kcalloc: to prevent the routine from allocating less memory than the caller might assume. For instance ipr_store_update_fw() uses request_firmware() (which is controlled by userspace) to drive the length argument to sgl_alloc_order(). If userpace gives too large a value this will corrupt kernel memory. So this math: nent = round_up(length, PAGE_SIZE << order) >> (PAGE_SHIFT + order); Needs to be checked, add a precondition to order does not help. I already proposed a straightforward algorithm you can use. Jason
