tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

mm: vmalloc: WARN_ON if mapping size is not PAGE_SIZE aligned

In mm/vmalloc.c, the function vmap_pte_range() assumes that the mapping
size is aligned to PAGE_SIZE. If this assumption is violated, the loop
will become infinite because the termination condition (`addr != end`)
will never be met. This can lead to overwriting other VA ranges and/or
random pages physically follow the page table.

It's the caller's responsibility to ensure that the mapping size is
aligned to PAGE_SIZE. However, the memory corruption is hard to root
cause. To identify the programming error in the caller easier, check
whether the mapping size is PAGE_SIZE aligned with WARN_ON_ONCE().

[yadong.qi@linux.alibaba.com: fix uninitialized value issue]
Closes: https://lore.kernel.org/r/202510110050.VG9YKMRK-lkp@intel.com/
Link: https://lkml.kernel.org/r/20251010014311.1689-1-yadong.qi@linux.alibaba.com
Signed-off-by: Yadong Qi <yadong.qi@linux.alibaba.com>
Reviewed-by: Huang Ying <ying.huang@linux.alibaba.com>
Reviewed-by: Dev Jain <dev.jain@arm.com>
Reviewed-by: Uladzislau Rezki (Sony) <urezki@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>

authored by

Yadong Qi and committed by
Andrew Morton a739e6b5 ca30ac47

+18 -11
+18 -11
mm/vmalloc.c
··· 100 100 struct page *page; 101 101 unsigned long size = PAGE_SIZE; 102 102 103 + if (WARN_ON_ONCE(!PAGE_ALIGNED(end - addr))) 104 + return -EINVAL; 105 + 103 106 pfn = phys_addr >> PAGE_SHIFT; 104 107 pte = pte_alloc_kernel_track(pmd, addr, mask); 105 108 if (!pte) ··· 170 167 { 171 168 pmd_t *pmd; 172 169 unsigned long next; 170 + int err = 0; 173 171 174 172 pmd = pmd_alloc_track(&init_mm, pud, addr, mask); 175 173 if (!pmd) ··· 184 180 continue; 185 181 } 186 182 187 - if (vmap_pte_range(pmd, addr, next, phys_addr, prot, max_page_shift, mask)) 188 - return -ENOMEM; 183 + err = vmap_pte_range(pmd, addr, next, phys_addr, prot, max_page_shift, mask); 184 + if (err) 185 + break; 189 186 } while (pmd++, phys_addr += (next - addr), addr = next, addr != end); 190 - return 0; 187 + return err; 191 188 } 192 189 193 190 static int vmap_try_huge_pud(pud_t *pud, unsigned long addr, unsigned long end, ··· 222 217 { 223 218 pud_t *pud; 224 219 unsigned long next; 220 + int err = 0; 225 221 226 222 pud = pud_alloc_track(&init_mm, p4d, addr, mask); 227 223 if (!pud) ··· 236 230 continue; 237 231 } 238 232 239 - if (vmap_pmd_range(pud, addr, next, phys_addr, prot, 240 - max_page_shift, mask)) 241 - return -ENOMEM; 233 + err = vmap_pmd_range(pud, addr, next, phys_addr, prot, max_page_shift, mask); 234 + if (err) 235 + break; 242 236 } while (pud++, phys_addr += (next - addr), addr = next, addr != end); 243 - return 0; 237 + return err; 244 238 } 245 239 246 240 static int vmap_try_huge_p4d(p4d_t *p4d, unsigned long addr, unsigned long end, ··· 274 268 { 275 269 p4d_t *p4d; 276 270 unsigned long next; 271 + int err = 0; 277 272 278 273 p4d = p4d_alloc_track(&init_mm, pgd, addr, mask); 279 274 if (!p4d) ··· 288 281 continue; 289 282 } 290 283 291 - if (vmap_pud_range(p4d, addr, next, phys_addr, prot, 292 - max_page_shift, mask)) 293 - return -ENOMEM; 284 + err = vmap_pud_range(p4d, addr, next, phys_addr, prot, max_page_shift, mask); 285 + if (err) 286 + break; 294 287 } while (p4d++, phys_addr += (next - addr), addr = next, addr != end); 295 - return 0; 288 + return err; 296 289 } 297 290 298 291 static int vmap_range_noflush(unsigned long addr, unsigned long end,