On 03.06.24 13:28, Anastasia Belova wrote:
nid may be equal to NUMA_NO_NODE=-1. Prevent accessing node_data
array by invalid index with check for nid.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: e83a437faa62 ("mm/memory_hotplug: introduce "auto-movable" online policy")
Signed-off-by: Anastasia Belova <abelova@xxxxxxxxxxxxx>
---
mm/memory_hotplug.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
index 431b1f6753c0..bb98ee8fe698 100644
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
@@ -846,7 +846,7 @@ static bool auto_movable_can_online_movable(int nid, struct memory_group *group,
unsigned long kernel_early_pages, movable_pages;
struct auto_movable_group_stats group_stats = {};
struct auto_movable_stats stats = {};
- pg_data_t *pgdat = NODE_DATA(nid);
+ pg_data_t *pgdat = (nid != NUMA_NO_NODE) ? NODE_DATA(nid) : NULL;
struct zone *zone;
int i;
pgdat is never dereferenced when "nid == NUMA_NO_NODE".
NODE_DATA is defined as
arch/arm64/include/asm/mmzone.h:#define NODE_DATA(nid) (node_data[(nid)])
arch/loongarch/include/asm/mmzone.h:#define NODE_DATA(nid) (node_data[(nid)])
arch/mips/include/asm/mach-ip27/mmzone.h:#define NODE_DATA(n) (&__node_data[(n)]->pglist)
arch/mips/include/asm/mach-loongson64/mmzone.h:#define NODE_DATA(n) (__node_data[n])
arch/powerpc/include/asm/mmzone.h:#define NODE_DATA(nid) (node_data[nid])
arch/riscv/include/asm/mmzone.h:#define NODE_DATA(nid) (node_data[(nid)])
arch/s390/include/asm/mmzone.h:#define NODE_DATA(nid) (node_data[nid])
arch/sh/include/asm/mmzone.h:#define NODE_DATA(nid) (node_data[nid])
arch/sparc/include/asm/mmzone.h:#define NODE_DATA(nid) (node_data[nid])
arch/x86/include/asm/mmzone_32.h:#define NODE_DATA(nid) (node_data[nid])
arch/x86/include/asm/mmzone_64.h:#define NODE_DATA(nid) (node_data[nid])
Regarding architectures that's actually support memory hotplug, this is pure pointer arithmetic.
(it is for mips as well, just less obvious)
So how is that a real problem? Do we have a reproducer?
--
Cheers,
David / dhildenb
