Linux-mm Archive on
 help / color / Atom feed
* [patch 075/158] mm/memory_hotplug.c: add a bounds check to __add_pages()
@ 2019-12-01  1:53 akpm
  0 siblings, 0 replies; only message in thread
From: akpm @ 2019-12-01  1:53 UTC (permalink / raw)
  To: akpm, alastair, dan.j.williams, david, linux-mm, mhocko,
	mm-commits, osalvador, pasha.tatashin, torvalds

From: Alastair D'Silva <>
Subject: mm/memory_hotplug.c: add a bounds check to __add_pages()

On PowerPC, the address ranges allocated to OpenCAPI LPC memory are
allocated from firmware.  These address ranges may be higher than what
older kernels permit, as we increased the maximum permissable address in
commit 4ffe713b7587 ("powerpc/mm: Increase the max addressable memory to
2PB").  It is possible that the addressable range may change again in the

In this scenario, we end up with a bogus section returned from
__section_nr (see the discussion on the thread "mm: Trigger bug on if a
section is not found in __section_nr").

Adding a check here means that we fail early and have an opportunity to
handle the error gracefully, rather than rumbling on and potentially
accessing an incorrect section.

Further discussion is also on the thread ("powerpc: Perform a bounds
check in arch_add_memory")

Signed-off-by: Alastair D'Silva <>
Reviewed-by: David Hildenbrand <>
Acked-by: Michal Hocko <>
Cc: Oscar Salvador <>
Cc: Pavel Tatashin <>
Cc: Dan Williams <>
Signed-off-by: Andrew Morton <>

 mm/memory_hotplug.c |   20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

--- a/mm/memory_hotplug.c~memory_hotplug-add-a-bounds-check-to-__add_pages
+++ a/mm/memory_hotplug.c
@@ -278,6 +278,22 @@ static int check_pfn_span(unsigned long
 	return 0;
+static int check_hotplug_memory_addressable(unsigned long pfn,
+					    unsigned long nr_pages)
+	const u64 max_addr = PFN_PHYS(pfn + nr_pages) - 1;
+	if (max_addr >> MAX_PHYSMEM_BITS) {
+		const u64 max_allowed = (1ull << (MAX_PHYSMEM_BITS + 1)) - 1;
+		WARN(1,
+		     "Hotplugged memory exceeds maximum addressable address, range=%#llx-%#llx, maximum=%#llx\n",
+		     (u64)PFN_PHYS(pfn), max_addr, max_allowed);
+		return -E2BIG;
+	}
+	return 0;
  * Reasonably generic function for adding memory.  It is
  * expected that archs that support memory hotplug will
@@ -291,6 +307,10 @@ int __ref __add_pages(int nid, unsigned
 	unsigned long nr, start_sec, end_sec;
 	struct vmem_altmap *altmap = restrictions->altmap;
+	err = check_hotplug_memory_addressable(pfn, nr_pages);
+	if (err)
+		return err;
 	if (altmap) {
 		 * Validate altmap is within bounds of the total request

^ permalink raw reply	[flat|nested] only message in thread

only message in thread, back to index

Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-12-01  1:53 [patch 075/158] mm/memory_hotplug.c: add a bounds check to __add_pages() akpm

Linux-mm Archive on

Archives are clonable:
	git clone --mirror linux-mm/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-mm linux-mm/ \
	public-inbox-index linux-mm

Example config snippet for mirrors

Newsgroup available over NNTP:

AGPL code for this site: git clone