The patch titled
Subject: mm/page_alloc: __alloc_pages_bulk(): do bounds check before accessing array
has been added to the -mm tree. Its filename is
mm-page_alloc-__alloc_pages_bulk-do-bounds-check-before-accessing-array.patch
This patch should soon appear at
https://ozlabs.org/~akpm/mmots/broken-out/mm-page_alloc-__alloc_pages_bulk-do-bounds-check-before-accessing-array.patch
and later at
https://ozlabs.org/~akpm/mmotm/broken-out/mm-page_alloc-__alloc_pages_bulk-do-bounds-check-before-accessing-array.patch
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Rasmus Villemoes <linux@xxxxxxxxxxxxxxxxxx>
Subject: mm/page_alloc: __alloc_pages_bulk(): do bounds check before accessing array
In the event that somebody would call this with an already fully populated
page_array, the last loop iteration would do an access beyond the end of
page_array.
It's of course extremely unlikely that would ever be done, but this
triggers my internal static analyzer. Also, if it really is not supposed
to be invoked this way (i.e., with no NULL entries in page_array), the
nr_populated<nr_pages check could simply be removed instead.
Link: https://lkml.kernel.org/r/20210507064504.1712559-1-linux@xxxxxxxxxxxxxxxxxx
Fixes: 0f87d9d30f21 (mm/page_alloc: add an array-based interface to the bulk page allocator)
Signed-off-by: Rasmus Villemoes <linux@xxxxxxxxxxxxxxxxxx>
Reviewed-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---
mm/page_alloc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/mm/page_alloc.c~mm-page_alloc-__alloc_pages_bulk-do-bounds-check-before-accessing-array
+++ a/mm/page_alloc.c
@@ -5053,7 +5053,7 @@ unsigned long __alloc_pages_bulk(gfp_t g
* Skip populated array elements to determine if any pages need
* to be allocated before disabling IRQs.
*/
- while (page_array && page_array[nr_populated] && nr_populated < nr_pages)
+ while (page_array && nr_populated < nr_pages && page_array[nr_populated])
nr_populated++;
/* Use the single page allocator for one page. */
_
Patches currently in -mm which might be from linux@xxxxxxxxxxxxxxxxxx are
mm-page_alloc-__alloc_pages_bulk-do-bounds-check-before-accessing-array.patch
