On Tue, 12 Apr 2022 16:10:14 +0800 lipeifeng@xxxxxxxx wrote: > From: lipeifeng <lipeifeng@xxxxxxxx> > > when we found a suitable gap_end(> info->high_limit), gap_end > must be set to info->high_limit. And we will get the gap_end > after computing highest gap address at the desired alignment. > > 2096 found: > 2097 if (gap_end > info->high_limit) > 2098 gap_end = info->high_limit; > 2099 > 2100 found_highest: > 2101 gap_end -= info->length; > 2102 gap_end -= (gap_end - info->align_offset) & info->align_mask; > 2103 > 2104 VM_BUG_ON(gap_end < info->low_limit); > 2105 VM_BUG_ON(gap_end < gap_start); > 2106 return gap_end; > > so we must promise: info->high_limit - info->low_limit >= > info->length + info->align_mask. > Or in rare cases(info->high_limit - info->low_limit < > info->length + info->align_mask) we will get the addr in > align-error if found suitable gap_end(> info->high_limit). > Thanks. What are the runtime affects of this bug, and how are you able to trigger it? > --- a/mm/mmap.c > +++ b/mm/mmap.c > @@ -2009,7 +2009,6 @@ static unsigned long unmapped_area_topdown(struct vm_unmapped_area_info *info) > if (length < info->length) > return -ENOMEM; > > - length = info->length; > /* > * Adjust search limits by the desired length. > * See implementation comment at top of unmapped_area(). > @@ -2021,6 +2020,8 @@ static unsigned long unmapped_area_topdown(struct vm_unmapped_area_info *info) > > if (info->low_limit > high_limit) > return -ENOMEM; > + > + length = info->length; > low_limit = info->low_limit + length; > > /* Check highest gap, which does not precede any rbtree node */ > -- > 2.7.4
