From: Qian Cai <cai@lca.pw>
To: akpm@linux-foundation.org
Cc: mhocko@suse.com, hannes@cmpxchg.org, guro@fb.com,
linux-mm@kvack.org, cgroups@vger.kernel.org,
linux-kernel@vger.kernel.org, Qian Cai <cai@lca.pw>
Subject: [PATCH -next] mm/vmscan: fix an undefined behavior for zone id
Date: Fri, 8 Nov 2019 15:44:07 -0500 [thread overview]
Message-ID: <20191108204407.1435-1-cai@lca.pw> (raw)
The -next commit "mm: vmscan: simplify lruvec_lru_size()" [1] introduced
an undefined behavior as zone_idx could equal to MAX_NR_ZONES, and then
zid is then out of range.
[ 5399.483257] LTP: starting mtest01w (mtest01 -p80 -w)
[ 5400.245051] ================================================================================
[ 5400.255784] UBSAN: Undefined behaviour in ./include/linux/memcontrol.h:536:26
[ 5400.265235] index 5 is out of range for type 'long unsigned int [5][5]'
[ 5400.273925] CPU: 28 PID: 455 Comm: kswapd7 Tainted: G W 5.4.0-rc6-next-20191108 #3
[ 5400.285461] Hardware name: HPE ProLiant DL385 Gen10/ProLiant DL385 Gen10, BIOS A40 07/10/2019
[ 5400.295784] Call Trace:
[ 5400.299483] dump_stack+0x7a/0xaa
[ 5400.304052] ubsan_epilogue+0x9/0x26
[ 5400.309180] __ubsan_handle_out_of_bounds.cold.13+0x2b/0x36
[ 5400.316192] inactive_list_is_low+0x8bb/0x9f0
[ 5400.321952] balance_pgdat+0x252/0x7d0
[ 5400.327006] kswapd+0x251/0x590
[ 5400.331725] ? finish_wait+0x90/0x90
[ 5400.336574] kthread+0x12a/0x140
[ 5400.341102] ? balance_pgdat+0x7d0/0x7d0
[ 5400.346330] ? kthread_create_worker_on_cpu+0x70/0x70
[ 5400.352810] ret_from_fork+0x27/0x50
[1] https://lore.kernel.org/linux-mm/20191022144803.302233-2-hannes@cmpxchg.org/
Signed-off-by: Qian Cai <cai@lca.pw>
---
mm/vmscan.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/mm/vmscan.c b/mm/vmscan.c
index d97985262dda..9485b80d6b5b 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -317,7 +317,7 @@ unsigned long lruvec_lru_size(struct lruvec *lruvec, enum lru_list lru, int zone
unsigned long size = 0;
int zid;
- for (zid = 0; zid <= zone_idx; zid++) {
+ for (zid = 0; zid < zone_idx; zid++) {
struct zone *zone = &lruvec_pgdat(lruvec)->node_zones[zid];
if (!managed_zone(zone))
--
2.21.0 (Apple Git-122.2)
next reply other threads:[~2019-11-08 20:44 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-11-08 20:44 Qian Cai [this message]
2019-11-08 21:26 ` [PATCH -next] mm/vmscan: fix an undefined behavior for zone id Qian Cai
2019-11-11 10:12 ` Michal Hocko
2019-11-11 13:05 ` Chris Down
2019-11-11 13:14 ` Chris Down
2019-11-11 13:28 ` Michal Hocko
2019-11-12 14:59 ` Johannes Weiner
2019-11-12 15:27 ` Michal Hocko
2019-11-12 16:16 ` Johannes Weiner
2019-11-12 16:24 ` Qian Cai
2019-11-12 16:31 ` Michal Hocko
2019-11-12 18:20 ` Johannes Weiner
2019-11-12 18:30 ` Michal Hocko
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20191108204407.1435-1-cai@lca.pw \
--to=cai@lca.pw \
--cc=akpm@linux-foundation.org \
--cc=cgroups@vger.kernel.org \
--cc=guro@fb.com \
--cc=hannes@cmpxchg.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=mhocko@suse.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).