The patch titled
Subject: [next] mm/vmalloc: fix read of uninitialized pointer area
has been removed from the -mm tree. Its filename was
mm-vmalloc-hugepage-vmalloc-mappings-fix.patch
This patch was dropped because it was folded into mm-vmalloc-hugepage-vmalloc-mappings.patch
------------------------------------------------------
From: Colin Ian King <colin.king@xxxxxxxxxxxxx>
Subject: [next] mm/vmalloc: fix read of uninitialized pointer area
There is a corner case where the sanity check of variable size fails
and branches to label fail and shift can be less than PAGE_SHIFT
causing area to never be assigned. This was picked up by static
analysis as follows:
1. var_decl: Declaring variable area without initializer.
struct vm_struct *area;
...
2. Condition !size, taking true branch.
if (!size || (size >> PAGE_SHIFT) > totalram_pages())
3. Jumping to label fail.
goto fail;
...
4. Condition shift > 12, taking false branch.
fail:
if (shift > PAGE_SHIFT) {
shift = PAGE_SHIFT;
align = real_align;
size = real_size;
goto again;
}
Uninitialized pointer read (UNINIT)
5. uninit_use: Using uninitialized value area.
if (!area) {
...
}
Fix this by setting area to NULL to avoid the uninitialized read
of area.
Addresses-Coverity: ("Uninitialized pointer read")
Link: https://lkml.kernel.org/r/20210318155955.18220-1-colin.king@xxxxxxxxxxxxx
Fixes: 92db9fec381b ("mm/vmalloc: hugepage vmalloc mappings")
Signed-off-by: Colin Ian King <colin.king@xxxxxxxxxxxxx>
Acked-by: Nicholas Piggin <npiggin@xxxxxxxxx>
Cc: Stephen Rothwell <sfr@xxxxxxxxxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---
mm/vmalloc.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/mm/vmalloc.c~mm-vmalloc-hugepage-vmalloc-mappings-fix
+++ a/mm/vmalloc.c
@@ -2879,8 +2879,10 @@ void *__vmalloc_node_range(unsigned long
unsigned long real_align = align;
unsigned int shift = PAGE_SHIFT;
- if (!size || (size >> PAGE_SHIFT) > totalram_pages())
+ if (!size || (size >> PAGE_SHIFT) > totalram_pages()) {
+ area = NULL;
goto fail;
+ }
if (vmap_allow_huge && !(vm_flags & VM_NO_HUGE_VMAP) &&
arch_vmap_pmd_supported(prot)) {
_
Patches currently in -mm which might be from colin.king@xxxxxxxxxxxxx are
mm-vmalloc-hugepage-vmalloc-mappings.patch
proc-fix-incorrect-pde_is_permanent-check.patch
mm-slab-fix-spelling-mistake-disired-desired.patch
