* + mm-vmalloc-hugepage-vmalloc-mappings-fix.patch added to -mm tree
@ 2021-03-19 23:10 akpm
2021-03-21 21:31 ` Stephen Rothwell
0 siblings, 1 reply; 2+ messages in thread
From: akpm @ 2021-03-19 23:10 UTC (permalink / raw)
To: colin.king, mm-commits, npiggin, sfr
The patch titled
Subject: [next] mm/vmalloc: fix read of uninitialized pointer area
has been added to the -mm tree. Its filename is
mm-vmalloc-hugepage-vmalloc-mappings-fix.patch
This patch should soon appear at
https://ozlabs.org/~akpm/mmots/broken-out/mm-vmalloc-hugepage-vmalloc-mappings-fix.patch
and later at
https://ozlabs.org/~akpm/mmotm/broken-out/mm-vmalloc-hugepage-vmalloc-mappings-fix.patch
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Colin Ian King <colin.king@canonical.com>
Subject: [next] mm/vmalloc: fix read of uninitialized pointer area
There is a corner case where the sanity check of variable size fails
and branches to label fail and shift can be less than PAGE_SHIFT
causing area to never be assigned. This was picked up by static
analysis as follows:
1. var_decl: Declaring variable area without initializer.
struct vm_struct *area;
...
2. Condition !size, taking true branch.
if (!size || (size >> PAGE_SHIFT) > totalram_pages())
3. Jumping to label fail.
goto fail;
...
4. Condition shift > 12, taking false branch.
fail:
if (shift > PAGE_SHIFT) {
shift = PAGE_SHIFT;
align = real_align;
size = real_size;
goto again;
}
Uninitialized pointer read (UNINIT)
5. uninit_use: Using uninitialized value area.
if (!area) {
...
}
Fix this by setting area to NULL to avoid the uninitialized read
of area.
Addresses-Coverity: ("Uninitialized pointer read")
Link: https://lkml.kernel.org/r/20210318155955.18220-1-colin.king@canonical.com
Fixes: 92db9fec381b ("mm/vmalloc: hugepage vmalloc mappings")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Cc: Stephen Rothwell <sfr@canb.auug.org.au>
Cc: Nicholas Piggin <npiggin@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---
mm/vmalloc.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/mm/vmalloc.c~mm-vmalloc-hugepage-vmalloc-mappings-fix
+++ a/mm/vmalloc.c
@@ -2879,8 +2879,10 @@ void *__vmalloc_node_range(unsigned long
unsigned long real_align = align;
unsigned int shift = PAGE_SHIFT;
- if (!size || (size >> PAGE_SHIFT) > totalram_pages())
+ if (!size || (size >> PAGE_SHIFT) > totalram_pages()) {
+ area = NULL;
goto fail;
+ }
if (vmap_allow_huge && !(vm_flags & VM_NO_HUGE_VMAP) &&
arch_vmap_pmd_supported(prot)) {
_
Patches currently in -mm which might be from colin.king@canonical.com are
mm-slab-fix-spelling-mistake-disired-desired.patch
mm-vmalloc-hugepage-vmalloc-mappings-fix.patch
mm-cma-support-sysfs-fix.patch
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: + mm-vmalloc-hugepage-vmalloc-mappings-fix.patch added to -mm tree
2021-03-19 23:10 + mm-vmalloc-hugepage-vmalloc-mappings-fix.patch added to -mm tree akpm
@ 2021-03-21 21:31 ` Stephen Rothwell
0 siblings, 0 replies; 2+ messages in thread
From: Stephen Rothwell @ 2021-03-21 21:31 UTC (permalink / raw)
To: akpm; +Cc: colin.king, mm-commits, npiggin, sfr
Hi all,
On Fri, 19 Mar 2021 16:10:51 -0700 akpm@linux-foundation.org wrote:
>
> The patch titled
> Subject: [next] mm/vmalloc: fix read of uninitialized pointer area
> has been added to the -mm tree. Its filename is
> mm-vmalloc-hugepage-vmalloc-mappings-fix.patch
Added to linux-next today.
--
Cheers,
Stephen Rothwell
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2021-03-21 21:39 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-03-19 23:10 + mm-vmalloc-hugepage-vmalloc-mappings-fix.patch added to -mm tree akpm
2021-03-21 21:31 ` Stephen Rothwell
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).