Subject: [merged] mm-vmallocc-fix-an-overflow-bug-in-alloc_vmap_area.patch removed from -mm tree To: zhangyanfei.yes@xxxxxxxxx,dbaluta@xxxxxxxxxxx,kosaki.motohiro@xxxxxxxxxxxxxx,minchan@xxxxxxxxxx,rientjes@xxxxxxxxxx,unix140@xxxxxxxxx,zhangyanfei@xxxxxxxxxxxxxx,mm-commits@xxxxxxxxxxxxxxx From: akpm@xxxxxxxxxxxxxxxxxxxx Date: Tue, 09 Jul 2013 16:20:19 -0700 The patch titled Subject: mm/vmalloc.c: fix an overflow bug in alloc_vmap_area() has been removed from the -mm tree. Its filename was mm-vmallocc-fix-an-overflow-bug-in-alloc_vmap_area.patch This patch was dropped because it was merged into mainline or a subsystem tree ------------------------------------------------------ From: Zhang Yanfei <zhangyanfei.yes@xxxxxxxxx> Subject: mm/vmalloc.c: fix an overflow bug in alloc_vmap_area() When searching a vmap area in the vmalloc space, we use (addr + size - 1) to check if the value is less than addr, which is an overflow. But we assign (addr + size) to vmap_area->va_end. So if we come across the below case: (addr + size - 1) : not overflow (addr + size) : overflow we will assign an overflow value (e.g 0) to vmap_area->va_end, And this will trigger BUG in __insert_vmap_area, causing system panic. So using (addr + size) to check the overflow should be the correct behaviour, not (addr + size - 1). Signed-off-by: Zhang Yanfei <zhangyanfei@xxxxxxxxxxxxxx> Reported-by: Ghennadi Procopciuc <unix140@xxxxxxxxx> Tested-by: Daniel Baluta <dbaluta@xxxxxxxxxxx> Cc: David Rientjes <rientjes@xxxxxxxxxx> Cc: Minchan Kim <minchan@xxxxxxxxxx> Cc: KOSAKI Motohiro <kosaki.motohiro@xxxxxxxxxxxxxx> Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> --- mm/vmalloc.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff -puN mm/vmalloc.c~mm-vmallocc-fix-an-overflow-bug-in-alloc_vmap_area mm/vmalloc.c --- a/mm/vmalloc.c~mm-vmallocc-fix-an-overflow-bug-in-alloc_vmap_area +++ a/mm/vmalloc.c @@ -388,12 +388,12 @@ nocache: addr = ALIGN(first->va_end, align); if (addr < vstart) goto nocache; - if (addr + size - 1 < addr) + if (addr + size < addr) goto overflow; } else { addr = ALIGN(vstart, align); - if (addr + size - 1 < addr) + if (addr + size < addr) goto overflow; n = vmap_area_root.rb_node; @@ -420,7 +420,7 @@ nocache: if (addr + cached_hole_size < first->va_start) cached_hole_size = first->va_start - addr; addr = ALIGN(first->va_end, align); - if (addr + size - 1 < addr) + if (addr + size < addr) goto overflow; if (list_is_last(&first->list, &vmap_area_list)) _ Patches currently in -mm which might be from zhangyanfei.yes@xxxxxxxxx are origin.patch -- To unsubscribe from this list: send the line "unsubscribe mm-commits" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html