Re: [PATCH] io_uring/memmap: bound io_pin_pages() by page array byte size

On Sun, 21 Jun 2026 06:59:33 +0530, Deepanshu Kartikey wrote:
> io_pin_pages() checks that nr_pages does not exceed INT_MAX, then
> allocates a struct page * array of nr_pages entries. kvmalloc() limits
> allocations to INT_MAX bytes, but the check counts pages, not bytes.
> On 64-bit each entry is 8 bytes, so the array hits the INT_MAX byte
> limit at INT_MAX / sizeof(struct page *) pages, well before the page
> count check fires.
> 
> [...]

Applied, thanks!

[1/1] io_uring/memmap: bound io_pin_pages() by page array byte size
      commit: 3996771b8f759729cba0a28007438c085f814d61

Best regards,
-- 
Jens Axboe