On Tue, 17 Apr 2018 16:13:48 +0530 Chintan Pandya <[email protected]> 
wrote:

> Client can call vunmap with some intermediate 'addr'
> which may not be the start of the VM area. Entire
> unmap code works with vm->vm_start which is proper
> but debug object API is called with 'addr'. This
> could be a problem within debug objects.
> 
> Pass proper start address into debug object API.
> 
> --- a/mm/vmalloc.c
> +++ b/mm/vmalloc.c
> @@ -1124,15 +1124,15 @@ void vm_unmap_ram(const void *mem, unsigned int count)
>       BUG_ON(addr > VMALLOC_END);
>       BUG_ON(!PAGE_ALIGNED(addr));
>  
> -     debug_check_no_locks_freed(mem, size);
> -
>       if (likely(count <= VMAP_MAX_ALLOC)) {
> +             debug_check_no_locks_freed(mem, size);
>               vb_free(mem, size);
>               return;
>       }
>  
>       va = find_vmap_area(addr);
>       BUG_ON(!va);
> +     debug_check_no_locks_freed(va->va_start, (va->va_end - va->va_start));
>       free_unmap_vmap_area(va);
>  }
>  EXPORT_SYMBOL(vm_unmap_ram);

hm, how did this sneak through?

mm/vmalloc.c:1139:29: warning: passing argument 1 of debug_check_no_locks_freed 
makes pointer from integer without a cast [-Wint-conversion]
  debug_check_no_locks_freed(va->va_start, (va->va_end - va->va_start));

--- a/mm/vmalloc.c~mm-vmalloc-pass-proper-vm_start-into-debugobjects-fix
+++ a/mm/vmalloc.c
@@ -1136,7 +1136,8 @@ void vm_unmap_ram(const void *mem, unsig
 
        va = find_vmap_area(addr);
        BUG_ON(!va);
-       debug_check_no_locks_freed(va->va_start, (va->va_end - va->va_start));
+       debug_check_no_locks_freed((void *)va->va_start,
+                                   (va->va_end - va->va_start));
        free_unmap_vmap_area(va);
 }
 EXPORT_SYMBOL(vm_unmap_ram);

Reply via email to