[folded-merged] mm-vmalloc-hugepage-vmalloc-mappings-fix.patch removed from -mm tree

[folded-merged] mm-vmalloc-hugepage-vmalloc-mappings-fix.patch removed from -mm tree

[akpm]

The patch titled
     Subject: [next] mm/vmalloc: fix read of uninitialized pointer area
has been removed from the -mm tree.  Its filename was
     mm-vmalloc-hugepage-vmalloc-mappings-fix.patch

This patch was dropped because it was folded into mm-vmalloc-hugepage-vmalloc-mappings.patch

------------------------------------------------------
From: Colin Ian King <colin.king@canonical.com>
Subject: [next] mm/vmalloc: fix read of uninitialized pointer area

There is a corner case where the sanity check of variable size fails
and branches to label fail and shift can be less than PAGE_SHIFT
causing area to never be assigned. This was picked up by static
analysis as follows:

    1. var_decl: Declaring variable area without initializer.
       struct vm_struct *area;

   ...

    2. Condition !size, taking true branch.
       if (!size || (size >> PAGE_SHIFT) > totalram_pages())
    3. Jumping to label fail.
               goto fail;

    ...

    4. Condition shift > 12, taking false branch.
	fail:
		if (shift > PAGE_SHIFT) {
			shift = PAGE_SHIFT;
			align = real_align;
			size = real_size;
			goto again;
		}

     Uninitialized pointer read (UNINIT)
     5. uninit_use: Using uninitialized value area.
 		if (!area) {
			...
		}

Fix this by setting area to NULL to avoid the uninitialized read
of area.

Addresses-Coverity: ("Uninitialized pointer read")
Link: https://lkml.kernel.org/r/20210318155955.18220-1-colin.king@canonical.com
Fixes: 92db9fec381b ("mm/vmalloc: hugepage vmalloc mappings")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Acked-by: Nicholas Piggin <npiggin@gmail.com>
Cc: Stephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 mm/vmalloc.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/mm/vmalloc.c~mm-vmalloc-hugepage-vmalloc-mappings-fix
+++ a/mm/vmalloc.c
@@ -2879,8 +2879,10 @@ void *__vmalloc_node_range(unsigned long
 	unsigned long real_align = align;
 	unsigned int shift = PAGE_SHIFT;
 
-	if (!size || (size >> PAGE_SHIFT) > totalram_pages())
+	if (!size || (size >> PAGE_SHIFT) > totalram_pages()) {
+		area = NULL;
 		goto fail;
+	}
 
 	if (vmap_allow_huge && !(vm_flags & VM_NO_HUGE_VMAP) &&
 			arch_vmap_pmd_supported(prot)) {
_

Patches currently in -mm which might be from colin.king@canonical.com are

mm-vmalloc-hugepage-vmalloc-mappings.patch
proc-fix-incorrect-pde_is_permanent-check.patch
mm-slab-fix-spelling-mistake-disired-desired.patch