On Fri, Jun 18, 2021 at 12:03:45PM +0300, Dan Carpenter wrote:
> Hello Mel Gorman,
>
> The patch 0f87d9d30f21: "mm/page_alloc: add an array-based interface
> to the bulk page allocator" from Apr 29, 2021, leads to the following
> static checker warning:
>
> mm/page_alloc.c:5338 __alloc_pages_bulk()
> warn: potentially one past the end of array 'page_array[nr_populated]'
>
Thanks Dan.
Does this work for you?
--8<---
mm/page_alloc: do bulk array bounds check after checking populated elements
Dan Carpenter reported the following
The patch 0f87d9d30f21: "mm/page_alloc: add an array-based interface
to the bulk page allocator" from Apr 29, 2021, leads to the following
static checker warning:
mm/page_alloc.c:5338 __alloc_pages_bulk()
warn: potentially one past the end of array 'page_array[nr_populated]'
The problem can occur if an array is passed in that is fully populated. That
potentially ends up allocating a single page and storing it past the end of
the array. This patch returns 0 if the array is fully populated.
Fixes: 0f87d9d30f21 ("mm/page_alloc: add an array-based interface to the bulk page allocator")
Reported-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
Signed-off-by: Mel Gorman <mgorman@xxxxxxxxxxxxxxxxxxxx>
---
mm/page_alloc.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 8836e54721ae..602deee90eb3 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -5243,6 +5243,10 @@ unsigned long __alloc_pages_bulk(gfp_t gfp, int preferred_nid,
while (page_array && nr_populated < nr_pages && page_array[nr_populated])
nr_populated++;
+ /* Already populated array? */
+ if (unlikely(page_array && nr_pages - nr_populated == 0))
+ return 0;
+
/* Use the single page allocator for one page. */
if (nr_pages - nr_populated == 1)
goto failed;
