From: Hao Ge <hao.ge@linux.dev>
To: Madhavan Srinivasan <maddy@linux.ibm.com>,
Michael Ellerman <mpe@ellerman.id.au>,
Nicholas Piggin <npiggin@gmail.com>,
"Christophe Leroy (CS GROUP)" <chleroy@kernel.org>,
"Ritesh Harjani (IBM)" <ritesh.list@gmail.com>,
Shrikanth Hegde <sshegde@linux.ibm.com>,
Alexander Potapenko <glider@google.com>,
Marco Elver <elver@google.com>,
Dmitry Vyukov <dvyukov@google.com>,
Andrew Morton <akpm@linux-foundation.org>,
Dennis Zhou <dennis@kernel.org>, Tejun Heo <tj@kernel.org>,
Christoph Lameter <cl@gentwo.org>,
Uladzislau Rezki <urezki@gmail.com>, Hao Ge <hao.ge@linux.dev>,
Suren Baghdasaryan <surenb@google.com>,
Dev Jain <dev.jain@arm.com>
Cc: linuxppc-dev@lists.ozlabs.org, linux-kernel@vger.kernel.org,
kasan-dev@googlegroups.com, linux-mm@kvack.org,
Sashiko <sashiko-bot@kernel.org>
Subject: [PATCH v3 06/10] mm/vmalloc: reject empty and unaligned ranges in __vmap_pages_range_noflush()
Date: Mon, 26 Oct 2026 16:03:25 +0800 [thread overview]
Message-ID: <20261026080329.140244-7-hao.ge@linux.dev> (raw)
In-Reply-To: <20261026080329.140244-1-hao.ge@linux.dev>
__vmap_pages_range_noflush() expects a non-empty, page-aligned
[addr, end) range but does not check it.
An empty range dies in the BUG_ON(addr >= end) of
vmap_small_pages_range_noflush() on the small-page path, while the
huge-page path maps nothing and returns 0.
An unaligned range is caught by vmap_pages_pte_range() on the
small-page path, but the huge-page path misses it, because its
chunks are always page-aligned, so the check in vmap_pte_range()
passes, and the mapping just starts at the page boundary below addr.
Check both at the entry of __vmap_pages_range_noflush() and return
-EINVAL.
Reported-by: Sashiko <sashiko-bot@kernel.org>
Signed-off-by: Hao Ge <hao.ge@linux.dev>
---
mm/vmalloc.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index c0f33392c6ad..4d74144dfaff 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -698,6 +698,12 @@ int __vmap_pages_range_noflush(unsigned long addr, unsigned long end,
{
unsigned int i, nr = (end - addr) >> PAGE_SHIFT;
+ if (WARN_ON_ONCE(addr >= end))
+ return -EINVAL;
+
+ if (WARN_ON_ONCE(!PAGE_ALIGNED(addr) || !PAGE_ALIGNED(end)))
+ return -EINVAL;
+
if (WARN_ON_ONCE(page_shift < PAGE_SHIFT))
return -EINVAL;
--
2.25.1
next prev parent reply other threads:[~2026-10-26 8:03 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-26 8:03 [PATCH v3 00/10] mm/vmalloc: fix up vmap error handling Hao Ge
2026-10-26 8:03 ` [PATCH v3 01/10] mm/kmsan: undo the shadow mapping when the origin mapping fails Hao Ge
2026-10-26 8:03 ` [PATCH v3 02/10] mm/kmsan: skip vunmap_range_noflush when KMSAN is disabled Hao Ge
2026-10-26 8:03 ` [PATCH v3 03/10] mm/vmalloc: clamp an unaligned range in vunmap_pte_range() Hao Ge
2026-10-26 8:03 ` [PATCH v3 04/10] mm/vmalloc: propagate errors in vmap_pages_p*d_range() Hao Ge
2026-10-26 8:03 ` [PATCH v3 05/10] mm/vmalloc: reject an unaligned range in vmap_pages_pte_range() Hao Ge
2026-10-26 8:03 ` Hao Ge [this message]
2026-10-26 8:03 ` [PATCH v3 07/10] mm/vmalloc: only flush the cache after the vmap succeeded Hao Ge
2026-10-26 8:03 ` [PATCH v3 08/10] mm/vmalloc: undo partial mappings inside the mapping functions Hao Ge
2026-10-26 8:03 ` [PATCH v3 09/10] powerpc: drop redundant unmaps of failed vmap mappings Hao Ge
2026-10-26 8:03 ` [PATCH v3 10/10] mm/percpu: stop unmapping the CPU that failed to map Hao Ge
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261026080329.140244-7-hao.ge@linux.dev \
--to=hao.ge@linux.dev \
--cc=akpm@linux-foundation.org \
--cc=chleroy@kernel.org \
--cc=cl@gentwo.org \
--cc=dennis@kernel.org \
--cc=dev.jain@arm.com \
--cc=dvyukov@google.com \
--cc=elver@google.com \
--cc=glider@google.com \
--cc=kasan-dev@googlegroups.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=linuxppc-dev@lists.ozlabs.org \
--cc=maddy@linux.ibm.com \
--cc=mpe@ellerman.id.au \
--cc=npiggin@gmail.com \
--cc=ritesh.list@gmail.com \
--cc=sashiko-bot@kernel.org \
--cc=sshegde@linux.ibm.com \
--cc=surenb@google.com \
--cc=tj@kernel.org \
--cc=urezki@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®