On 7/7/2026 9:19 PM, Hao-Qun Huang wrote:
create_sgt() receives the BO size as a u64 but stores the number of pages in an int. qaic_create_bo_ioctl() page-aligns the user-supplied size without an upper bound, so DIV_ROUND_UP(size, PAGE_SIZE) can exceed INT_MAX and truncate when assigned to nr_pages.When the page count wraps to a small positive value (for example a BO larger than 16 TiB on a 4 KiB page kernel), create_sgt() succeeds after allocating only a handful of pages while the GEM object still records the full size, so the request never fails with -ENOMEM. The temporary pages array and the allocation loop both use the truncated count, so the backing SG table ends up smaller than obj->size. Later slice operations validate against obj->size and then clone ranges from this short sgt. Compute the page count as a u64 and reject sizes that do not fit in nr_pages before the narrowing conversion. Fixes: ff13be830333 ("accel/qaic: Add datapath") Assisted-by: Claude:claude-fable-5 Signed-off-by: Hao-Qun Huang <[email protected]>
Reviewed-by: Jeff Hugo <[email protected]>
