6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uros Bizjak ubizjak@gmail.com
[ Upstream commit f8cd9193b62e92ad25def5370ca8ea2bc7585381 ]
The type of u argument of atomic_long_inc_below() should be long to avoid unwanted truncation to int.
The patch fixes the wrong argument type of an internal function to prevent unwanted argument truncation. It fixes an internal locking primitive; it should not have any direct effect on userspace.
Mark said
: AFAICT there's no problem in practice because atomic_long_inc_below() : is only used by inc_ucount(), and it looks like the value is : constrained between 0 and INT_MAX. : : In inc_ucount() the limit value is taken from : user_namespace::ucount_max[], and AFAICT that's only written by : sysctls, to the table setup by setup_userns_sysctls(), where : UCOUNT_ENTRY() limits the value between 0 and INT_MAX. : : This is certainly a cleanup, but there might be no functional issue in : practice as above.
Link: https://lkml.kernel.org/r/20250721174610.28361-1-ubizjak@gmail.com Fixes: f9c82a4ea89c ("Increase size of ucounts to atomic_long_t") Signed-off-by: Uros Bizjak ubizjak@gmail.com Reviewed-by: "Eric W. Biederman" ebiederm@xmission.com Cc: Sebastian Andrzej Siewior bigeasy@linutronix.de Cc: "Paul E. McKenney" paulmck@kernel.org Cc: Alexey Gladkov legion@kernel.org Cc: Roman Gushchin roman.gushchin@linux.dev Cc: MengEn Sun mengensun@tencent.com Cc: "Thomas Weißschuh" linux@weissschuh.net Cc: Mark Rutland mark.rutland@arm.com Signed-off-by: Andrew Morton akpm@linux-foundation.org Signed-off-by: Sasha Levin sashal@kernel.org --- kernel/ucount.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/ucount.c b/kernel/ucount.c index 3456018730b6..a7fd89693bd2 100644 --- a/kernel/ucount.c +++ b/kernel/ucount.c @@ -213,7 +213,7 @@ void put_ucounts(struct ucounts *ucounts) } }
-static inline bool atomic_long_inc_below(atomic_long_t *v, int u) +static inline bool atomic_long_inc_below(atomic_long_t *v, long u) { long c, old; c = atomic_long_read(v);