From: "Uladzislau Rezki (Sony)" <ure...@gmail.com> [ Upstream commit afd07389d3f4933c7f7817a92fb5e053d59a3182 ]
One of the vmalloc stress test case triggers the kernel BUG(): <snip> [60.562151] ------------[ cut here ]------------ [60.562154] kernel BUG at mm/vmalloc.c:512! [60.562206] invalid opcode: 0000 [#1] PREEMPT SMP PTI [60.562247] CPU: 0 PID: 430 Comm: vmalloc_test/0 Not tainted 4.20.0+ #161 [60.562293] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014 [60.562351] RIP: 0010:alloc_vmap_area+0x36f/0x390 <snip> it can happen due to big align request resulting in overflowing of calculated address, i.e. it becomes 0 after ALIGN()'s fixup. Fix it by checking if calculated address is within vstart/vend range. Link: http://lkml.kernel.org/r/20190124115648.9433-2-ure...@gmail.com Signed-off-by: Uladzislau Rezki (Sony) <ure...@gmail.com> Reviewed-by: Andrew Morton <a...@linux-foundation.org> Cc: Ingo Molnar <mi...@elte.hu> Cc: Joel Fernandes <joe...@google.com> Cc: Matthew Wilcox <wi...@infradead.org> Cc: Michal Hocko <mho...@suse.com> Cc: Oleksiy Avramchenko <oleksiy.avramche...@sonymobile.com> Cc: Steven Rostedt <rost...@goodmis.org> Cc: Tejun Heo <t...@kernel.org> Cc: Thomas Garnier <thgar...@google.com> Cc: Thomas Gleixner <t...@linutronix.de> Signed-off-by: Andrew Morton <a...@linux-foundation.org> Signed-off-by: Linus Torvalds <torva...@linux-foundation.org> Signed-off-by: Sasha Levin <sas...@kernel.org> --- mm/vmalloc.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/mm/vmalloc.c b/mm/vmalloc.c index 8d9f636d0c98..6c906f6f16cc 100644 --- a/mm/vmalloc.c +++ b/mm/vmalloc.c @@ -498,7 +498,11 @@ static struct vmap_area *alloc_vmap_area(unsigned long size, } found: - if (addr + size > vend) + /* + * Check also calculated address against the vstart, + * because it can be 0 because of big align request. + */ + if (addr + size > vend || addr < vstart) goto overflow; va->va_start = addr; -- 2.19.1
