09.10.2026 21:38, Dmitry Osipenko пишет:
> 24.09.2026 12:55, Honglei Huang пишет:
>> + mm = current->mm;
>> + mmgrab(mm);
>> + lock_limit = rlimit(RLIMIT_MEMLOCK) >> PAGE_SHIFT;
>> + new_pinned = atomic64_add_return(userptr->npages, &mm->pinned_vm);
>> + if (new_pinned < 0 ||
>> + (new_pinned > lock_limit && !capable(CAP_IPC_LOCK))) {
>> + atomic64_sub(userptr->npages, &mm->pinned_vm)
>
> At a quick glance over other kernel code touching pinned_vm, nobody else
> check for new_pinned < 0 and then doing atomic64_sub() for the negative
> value will be incorrect.
Though no, negative will restore pinned_vm. Still neg looks confusing
and shouldn't be needed as such overflow shouldn't be possible.
--
Best regards,
Dmitry
