[PATCH v4 3/9] mm/vmalloc: BUG_ON() on an unaligned range in vmap_range_noflush()

[Hao Ge <hao.ge@linux.dev>]

commit a739e6b557af ("mm: vmalloc: WARN_ON if mapping size is not
PAGE_SIZE aligned") put the check in vmap_pte_range(), which is too
late, because the upper levels may already have installed page
tables for a range that is rejected anyway.

The pte loop maps whole pages and stops only when addr lands
exactly on end.  An unaligned end lets addr jump over it and the
loop keeps mapping past the range.  An unaligned start maps the
page below the range and usually misses end too.  Such a range is
never a legitimate request, and the corruption it leaves behind is
hard to attribute to the caller afterwards, so bug out on addr and
end at the entry of vmap_range_noflush() and drop the check from
vmap_pte_range().

Signed-off-by: Hao Ge <hao.ge@linux.dev>
---
 mm/vmalloc.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index 093b8d5f7b0e..27f2674a5556 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -125,9 +125,6 @@ static int vmap_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end,
 	unsigned long size;
 	unsigned int nr_pages;
 
-	if (WARN_ON_ONCE(!PAGE_ALIGNED(end - addr)))
-		return -EINVAL;
-
 	pfn = phys_addr >> PAGE_SHIFT;
 	pte = pte_alloc_kernel_track(pmd, addr, mask);
 	if (!pte)
@@ -347,6 +344,7 @@ static int vmap_range_noflush(unsigned long addr, unsigned long end,
 	 */
 	might_sleep();
 	BUG_ON(addr >= end);
+	BUG_ON(!PAGE_ALIGNED(addr) || !PAGE_ALIGNED(end));
 
 	start = addr;
 	pgd = pgd_offset_k(addr);
-- 
2.25.1