diff options
| author | Uladzislau Rezki (Sony) | 2019-03-06 00:45:59 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman | 2019-04-05 22:32:58 +0200 |
| commit | 8a0fc62e331e15b1fef1b29ed5909da03f4a8cf5 (patch) | |
| tree | 3ae5fab2412b9672c49dc7c7d504295d3d8ebef5 /mm | |
| parent | mm, mempolicy: fix uninit memory access (diff) | |
| download | kernel-qcow2-linux-8a0fc62e331e15b1fef1b29ed5909da03f4a8cf5.tar.gz kernel-qcow2-linux-8a0fc62e331e15b1fef1b29ed5909da03f4a8cf5.tar.xz kernel-qcow2-linux-8a0fc62e331e15b1fef1b29ed5909da03f4a8cf5.zip | |
mm/vmalloc.c: fix kernel BUG at mm/vmalloc.c:512!
[ Upstream commit afd07389d3f4933c7f7817a92fb5e053d59a3182 ]
One of the vmalloc stress test case triggers the kernel BUG():
<snip>
[60.562151] ------------[ cut here ]------------
[60.562154] kernel BUG at mm/vmalloc.c:512!
[60.562206] invalid opcode: 0000 [#1] PREEMPT SMP PTI
[60.562247] CPU: 0 PID: 430 Comm: vmalloc_test/0 Not tainted 4.20.0+ #161
[60.562293] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014
[60.562351] RIP: 0010:alloc_vmap_area+0x36f/0x390
<snip>
it can happen due to big align request resulting in overflowing of
calculated address, i.e. it becomes 0 after ALIGN()'s fixup.
Fix it by checking if calculated address is within vstart/vend range.
Link: http://lkml.kernel.org/r/20190124115648.9433-2-urezki@gmail.com
Signed-off-by: Uladzislau Rezki (Sony) <urezki@gmail.com>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Ingo Molnar <mingo@elte.hu>
Cc: Joel Fernandes <joelaf@google.com>
Cc: Matthew Wilcox <willy@infradead.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Oleksiy Avramchenko <oleksiy.avramchenko@sonymobile.com>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Tejun Heo <tj@kernel.org>
Cc: Thomas Garnier <thgarnie@google.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'mm')
| -rw-r--r-- | mm/vmalloc.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/mm/vmalloc.c b/mm/vmalloc.c index 91a789a46b12..a46ec261a44e 100644 --- a/mm/vmalloc.c +++ b/mm/vmalloc.c @@ -498,7 +498,11 @@ nocache: } found: - if (addr + size > vend) + /* + * Check also calculated address against the vstart, + * because it can be 0 because of big align request. + */ + if (addr + size > vend || addr < vstart) goto overflow; va->va_start = addr; |