On Tue, 23 Jun 2026 10:51:59 +0000, Tarun Sahu <[email protected]> wrote: > In memfd_luo_finish() and memfd_luo_retrieve(), phys_to_virt() was called > on args->serialized_data before checking if the physical address is valid. > Since physical address 0 does not map to virtual NULL (due to direct > mapping offsets), the subsequent check 'if (!ser)' was ineffective at > catching a missing serialized_data, leading to unsafe dereferences later. > > Validate that args->serialized_data is non-zero before calling > phys_to_virt(). > > [...]
Reviewed-by: Pasha Tatashin <[email protected]> -- Pasha Tatashin <[email protected]>
