write_to_hugetlbfs currently parses the -s size argument with atoi()
into an int. This silently accepts malformed input, cannot report overflow,
and can truncate large sizes.

--- Error log ---
 # uname -r
 6.12.0-xxx.el10.aarch64+64k

 # ls /sys/kernel/mm/hugepages/hugepages-*
 hugepages-16777216kB/  hugepages-2048kB/  hugepages-524288kB/

 #./charge_reserved_hugetlb.sh -cgroup-v2
 # -----------------------------------------
 ...
 # nr hugepages = 10
 # writing cgroup limit: 5368709120
 # writing reseravation limit: 5368709120
 ...
 # Writing to this path: /mnt/huge/test
 # Writing this size: -1610612736        <--------

Switch size to size_t and parse -s using strtoull() with proper validation.
Also print the size using %zu.

This makes the test utility more robust and avoids undefined/incorrect
behavior with large or invalid -s values.

Signed-off-by: Li Wang <[email protected]>
Cc: David Hildenbrand <[email protected]>
Cc: Mark Brown <[email protected]>
Cc: Shuah Khan <[email protected]>
Cc: Waiman Long <[email protected]>
---
 .../testing/selftests/mm/write_to_hugetlbfs.c | 19 ++++++++++++++++---
 1 file changed, 16 insertions(+), 3 deletions(-)

diff --git a/tools/testing/selftests/mm/write_to_hugetlbfs.c 
b/tools/testing/selftests/mm/write_to_hugetlbfs.c
index 34c91f7e6128..61f34b35dc27 100644
--- a/tools/testing/selftests/mm/write_to_hugetlbfs.c
+++ b/tools/testing/selftests/mm/write_to_hugetlbfs.c
@@ -68,7 +68,7 @@ int main(int argc, char **argv)
        int key = 0;
        int *ptr = NULL;
        int c = 0;
-       int size = 0;
+       size_t size = 0;
        char path[256] = "";
        enum method method = MAX_METHOD;
        int want_sleep = 0, private = 0;
@@ -86,7 +86,20 @@ int main(int argc, char **argv)
        while ((c = getopt(argc, argv, "s:p:m:owlrn")) != -1) {
                switch (c) {
                case 's':
-                       size = atoi(optarg);
+                       errno = 0;
+                       char *end = NULL;
+                       unsigned long long tmp = strtoull(optarg, &end, 10);
+                       if (errno || end == optarg || *end != '\0') {
+                               errno = EINVAL;
+                               perror("Invalid -s size");
+                               exit_usage();
+                       }
+                       if (tmp == 0) {
+                               errno = EINVAL;
+                               perror("size not found");
+                               exit_usage();
+                       }
+                       size = (size_t)tmp;
                        break;
                case 'p':
                        strncpy(path, optarg, sizeof(path) - 1);
@@ -131,7 +144,7 @@ int main(int argc, char **argv)
        }
 
        if (size != 0) {
-               printf("Writing this size: %d\n", size);
+               printf("Writing this size: %zu\n", size);
        } else {
                errno = EINVAL;
                perror("size not found");
-- 
2.49.0


Reply via email to