On Tue, 17 Apr 2018 16:13:48 +0530 Chintan Pandya <cpandya@xxxxxxxxxxxxxx> wrote: > Client can call vunmap with some intermediate 'addr' > which may not be the start of the VM area. Entire > unmap code works with vm->vm_start which is proper > but debug object API is called with 'addr'. This > could be a problem within debug objects. > > Pass proper start address into debug object API. > > --- a/mm/vmalloc.c > +++ b/mm/vmalloc.c > @@ -1124,15 +1124,15 @@ void vm_unmap_ram(const void *mem, unsigned int count) > BUG_ON(addr > VMALLOC_END); > BUG_ON(!PAGE_ALIGNED(addr)); > > - debug_check_no_locks_freed(mem, size); > - > if (likely(count <= VMAP_MAX_ALLOC)) { > + debug_check_no_locks_freed(mem, size); > vb_free(mem, size); > return; > } > > va = find_vmap_area(addr); > BUG_ON(!va); > + debug_check_no_locks_freed(va->va_start, (va->va_end - va->va_start)); > free_unmap_vmap_area(va); > } > EXPORT_SYMBOL(vm_unmap_ram); hm, how did this sneak through? mm/vmalloc.c:1139:29: warning: passing argument 1 of debug_check_no_locks_freed makes pointer from integer without a cast [-Wint-conversion] debug_check_no_locks_freed(va->va_start, (va->va_end - va->va_start)); --- a/mm/vmalloc.c~mm-vmalloc-pass-proper-vm_start-into-debugobjects-fix +++ a/mm/vmalloc.c @@ -1136,7 +1136,8 @@ void vm_unmap_ram(const void *mem, unsig va = find_vmap_area(addr); BUG_ON(!va); - debug_check_no_locks_freed(va->va_start, (va->va_end - va->va_start)); + debug_check_no_locks_freed((void *)va->va_start, + (va->va_end - va->va_start)); free_unmap_vmap_area(va); } EXPORT_SYMBOL(vm_unmap_ram);