lkml.org 
[lkml]   [2019]   [Mar]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 4.9 12/87] mm/vmalloc.c: fix kernel BUG at mm/vmalloc.c:512!
    Date
    From: "Uladzislau Rezki (Sony)" <urezki@gmail.com>

    [ Upstream commit afd07389d3f4933c7f7817a92fb5e053d59a3182 ]

    One of the vmalloc stress test case triggers the kernel BUG():

    <snip>
    [60.562151] ------------[ cut here ]------------
    [60.562154] kernel BUG at mm/vmalloc.c:512!
    [60.562206] invalid opcode: 0000 [#1] PREEMPT SMP PTI
    [60.562247] CPU: 0 PID: 430 Comm: vmalloc_test/0 Not tainted 4.20.0+ #161
    [60.562293] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014
    [60.562351] RIP: 0010:alloc_vmap_area+0x36f/0x390
    <snip>

    it can happen due to big align request resulting in overflowing of
    calculated address, i.e. it becomes 0 after ALIGN()'s fixup.

    Fix it by checking if calculated address is within vstart/vend range.

    Link: http://lkml.kernel.org/r/20190124115648.9433-2-urezki@gmail.com
    Signed-off-by: Uladzislau Rezki (Sony) <urezki@gmail.com>
    Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
    Cc: Ingo Molnar <mingo@elte.hu>
    Cc: Joel Fernandes <joelaf@google.com>
    Cc: Matthew Wilcox <willy@infradead.org>
    Cc: Michal Hocko <mhocko@suse.com>
    Cc: Oleksiy Avramchenko <oleksiy.avramchenko@sonymobile.com>
    Cc: Steven Rostedt <rostedt@goodmis.org>
    Cc: Tejun Heo <tj@kernel.org>
    Cc: Thomas Garnier <thgarnie@google.com>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    mm/vmalloc.c | 6 +++++-
    1 file changed, 5 insertions(+), 1 deletion(-)

    diff --git a/mm/vmalloc.c b/mm/vmalloc.c
    index e6aa073f01df..73afe460caf0 100644
    --- a/mm/vmalloc.c
    +++ b/mm/vmalloc.c
    @@ -459,7 +459,11 @@ static struct vmap_area *alloc_vmap_area(unsigned long size,
    }

    found:
    - if (addr + size > vend)
    + /*
    + * Check also calculated address against the vstart,
    + * because it can be 0 because of big align request.
    + */
    + if (addr + size > vend || addr < vstart)
    goto overflow;

    va->va_start = addr;
    --
    2.19.1
    \
     
     \ /
      Last update: 2019-03-27 19:45    [W:3.209 / U:0.960 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site