From d558a6a9a5797c9b1cb7064f7413f30dba7a63ac Mon Sep 17 00:00:00 2001 From: Rasmus Villemoes Date: Wed, 14 Jul 2021 07:06:27 +0000 Subject: [PATCH] mm/page_alloc: __alloc_pages_bulk(): do bounds check before accessing array mainline inclusion from mainline-5.13 commit b08e50dd64489e3997029d204f761cb57a3762d2 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I3ZVL2 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b08e50dd64489e3997029d204f761cb57a3762d2 ------------------------------------------------- In the event that somebody would call this with an already fully populated page_array, the last loop iteration would do an access beyond the end of page_array. It's of course extremely unlikely that would ever be done, but this triggers my internal static analyzer. Also, if it really is not supposed to be invoked this way (i.e., with no NULL entries in page_array), the nr_populated Acked-by: Mel Gorman Reviewed-by: Andrew Morton Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds (cherry picked from commit b08e50dd64489e3997029d204f761cb57a3762d2) Signed-off-by: Yongqiang Liu Reviewed-by: Tong Tiangen Signed-off-by: Zheng Zengkai --- mm/page_alloc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mm/page_alloc.c b/mm/page_alloc.c index c3bc5fb876f1..f271929abeab 100644 --- a/mm/page_alloc.c +++ b/mm/page_alloc.c @@ -4960,7 +4960,7 @@ unsigned long __alloc_pages_bulk(gfp_t gfp, int preferred_nid, * Skip populated array elements to determine if any pages need * to be allocated before disabling IRQs. */ - while (page_array && page_array[nr_populated] && nr_populated < nr_pages) + while (page_array && nr_populated < nr_pages && page_array[nr_populated]) nr_populated++; /* Use the single page allocator for one page. */ -- GitLab