From 37d0aff3d2f45e9a69dcbf0093421fe4aa2632a9 Mon Sep 17 00:00:00 2001 From: Mel Gorman Date: Wed, 14 Jul 2021 07:06:28 +0000 Subject: [PATCH] mm/page_alloc: do bulk array bounds check after checking populated elements mainline inclusion from mainline-5.13 commit b3b64ebd38225d8032b5db42938d969b602040c2 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I3ZVL2 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b3b64ebd38225d8032b5db42938d969b602040c2 ------------------------------------------------- Dan Carpenter reported the following The patch 0f87d9d30f21: "mm/page_alloc: add an array-based interface to the bulk page allocator" from Apr 29, 2021, leads to the following static checker warning: mm/page_alloc.c:5338 __alloc_pages_bulk() warn: potentially one past the end of array 'page_array[nr_populated]' The problem can occur if an array is passed in that is fully populated. That potentially ends up allocating a single page and storing it past the end of the array. This patch returns 0 if the array is fully populated. Link: https://lkml.kernel.org/r/20210618125102.GU30378@techsingularity.net Fixes: 0f87d9d30f21 ("mm/page_alloc: add an array-based interface to the bulk page allocator") Signed-off-by: Mel Gorman Reported-by: Dan Carpenter Cc: Jesper Dangaard Brouer Cc: Vlastimil Babka Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds (cherry picked from commit b3b64ebd38225d8032b5db42938d969b602040c2) Signed-off-by: Yongqiang Liu Reviewed-by: Tong Tiangen Signed-off-by: Zheng Zengkai --- mm/page_alloc.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/mm/page_alloc.c b/mm/page_alloc.c index f271929abeab..853d65d5420f 100644 --- a/mm/page_alloc.c +++ b/mm/page_alloc.c @@ -4963,6 +4963,10 @@ unsigned long __alloc_pages_bulk(gfp_t gfp, int preferred_nid, while (page_array && nr_populated < nr_pages && page_array[nr_populated]) nr_populated++; + /* Already populated array? */ + if (unlikely(page_array && nr_pages - nr_populated == 0)) + return 0; + /* Use the single page allocator for one page. */ if (nr_pages - nr_populated == 1) goto failed; -- GitLab