The patch titled
Subject: [next] mm/vmalloc: fix read of uninitialized pointer area
has been added to the -mm tree. Its filename is
mm-vmalloc-hugepage-vmalloc-mappings-fix.patch
This patch should soon appear at
https://ozlabs.org/~akpm/mmots/broken-out/mm-vmalloc-hugepage-vmalloc-mappings-fix.patch
and later at
https://ozlabs.org/~akpm/mmotm/broken-out/mm-vmalloc-hugepage-vmalloc-mappings-fix.patch
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Colin Ian King <colin.king@xxxxxxxxxxxxx>
Subject: [next] mm/vmalloc: fix read of uninitialized pointer area
There is a corner case where the sanity check of variable size fails
and branches to label fail and shift can be less than PAGE_SHIFT
causing area to never be assigned. This was picked up by static
analysis as follows:
1. var_decl: Declaring variable area without initializer.
struct vm_struct *area;
...
2. Condition !size, taking true branch.
if (!size || (size >> PAGE_SHIFT) > totalram_pages())
3. Jumping to label fail.
goto fail;
...
4. Condition shift > 12, taking false branch.
fail:
if (shift > PAGE_SHIFT) {
shift = PAGE_SHIFT;
align = real_align;
size = real_size;
goto again;
}
Uninitialized pointer read (UNINIT)
5. uninit_use: Using uninitialized value area.
if (!area) {
...
}
Fix this by setting area to NULL to avoid the uninitialized read
of area.
Addresses-Coverity: ("Uninitialized pointer read")
Link: https://lkml.kernel.org/r/20210318155955.18220-1-colin.king@xxxxxxxxxxxxx
Fixes: 92db9fec381b ("mm/vmalloc: hugepage vmalloc mappings")
Signed-off-by: Colin Ian King <colin.king@xxxxxxxxxxxxx>
Cc: Stephen Rothwell <sfr@xxxxxxxxxxxxxxxx>
Cc: Nicholas Piggin <npiggin@xxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---
mm/vmalloc.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/mm/vmalloc.c~mm-vmalloc-hugepage-vmalloc-mappings-fix
+++ a/mm/vmalloc.c
@@ -2879,8 +2879,10 @@ void *__vmalloc_node_range(unsigned long
unsigned long real_align = align;
unsigned int shift = PAGE_SHIFT;
- if (!size || (size >> PAGE_SHIFT) > totalram_pages())
+ if (!size || (size >> PAGE_SHIFT) > totalram_pages()) {
+ area = NULL;
goto fail;
+ }
if (vmap_allow_huge && !(vm_flags & VM_NO_HUGE_VMAP) &&
arch_vmap_pmd_supported(prot)) {
_
Patches currently in -mm which might be from colin.king@xxxxxxxxxxxxx are
mm-slab-fix-spelling-mistake-disired-desired.patch
mm-vmalloc-hugepage-vmalloc-mappings-fix.patch
mm-cma-support-sysfs-fix.patch
