* [folded-merged] mm-vmalloc-hugepage-vmalloc-mappings-fix.patch removed from -mm tree
@ 2021-04-30 5:27 akpm
0 siblings, 0 replies; only message in thread
From: akpm @ 2021-04-30 5:27 UTC (permalink / raw)
To: colin.king, mm-commits, npiggin, sfr
The patch titled
Subject: [next] mm/vmalloc: fix read of uninitialized pointer area
has been removed from the -mm tree. Its filename was
mm-vmalloc-hugepage-vmalloc-mappings-fix.patch
This patch was dropped because it was folded into mm-vmalloc-hugepage-vmalloc-mappings.patch
------------------------------------------------------
From: Colin Ian King <colin.king@canonical.com>
Subject: [next] mm/vmalloc: fix read of uninitialized pointer area
There is a corner case where the sanity check of variable size fails
and branches to label fail and shift can be less than PAGE_SHIFT
causing area to never be assigned. This was picked up by static
analysis as follows:
1. var_decl: Declaring variable area without initializer.
struct vm_struct *area;
...
2. Condition !size, taking true branch.
if (!size || (size >> PAGE_SHIFT) > totalram_pages())
3. Jumping to label fail.
goto fail;
...
4. Condition shift > 12, taking false branch.
fail:
if (shift > PAGE_SHIFT) {
shift = PAGE_SHIFT;
align = real_align;
size = real_size;
goto again;
}
Uninitialized pointer read (UNINIT)
5. uninit_use: Using uninitialized value area.
if (!area) {
...
}
Fix this by setting area to NULL to avoid the uninitialized read
of area.
Addresses-Coverity: ("Uninitialized pointer read")
Link: https://lkml.kernel.org/r/20210318155955.18220-1-colin.king@canonical.com
Fixes: 92db9fec381b ("mm/vmalloc: hugepage vmalloc mappings")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Acked-by: Nicholas Piggin <npiggin@gmail.com>
Cc: Stephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---
mm/vmalloc.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/mm/vmalloc.c~mm-vmalloc-hugepage-vmalloc-mappings-fix
+++ a/mm/vmalloc.c
@@ -2879,8 +2879,10 @@ void *__vmalloc_node_range(unsigned long
unsigned long real_align = align;
unsigned int shift = PAGE_SHIFT;
- if (!size || (size >> PAGE_SHIFT) > totalram_pages())
+ if (!size || (size >> PAGE_SHIFT) > totalram_pages()) {
+ area = NULL;
goto fail;
+ }
if (vmap_allow_huge && !(vm_flags & VM_NO_HUGE_VMAP) &&
arch_vmap_pmd_supported(prot)) {
_
Patches currently in -mm which might be from colin.king@canonical.com are
mm-vmalloc-hugepage-vmalloc-mappings.patch
proc-fix-incorrect-pde_is_permanent-check.patch
mm-slab-fix-spelling-mistake-disired-desired.patch
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2021-04-30 5:27 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-04-30 5:27 [folded-merged] mm-vmalloc-hugepage-vmalloc-mappings-fix.patch removed from -mm tree akpm
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).