On 10/4/2026 10:47 AM, Sidong Yang wrote:
task_count is a u32 from userspace, but rocket_copy_tasks() walks it with an int index, which would overflow for counts above INT_MAX. That is not reachable today, since kvmalloc_objs() rejects any count above INT_MAX / 16, but use an unsigned index to match the type.Reported-by: Sashiko <[email protected]> Closes: https://lore.kernel.org/all/[email protected]/ Signed-off-by: Sidong Yang <[email protected]>
Reviewed-by: Jeff Hugo <[email protected]>
