From: zijun_hu <zijun...@htc.com>

fix the following bug:
 - endless loop maybe happen when v[un]mapping improper ranges
   whose either boundary is not aligned to page

Signed-off-by: zijun_hu <zijun...@htc.com>
---
 mm/vmalloc.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index 5eeecc3..16fe957 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -67,7 +67,7 @@ static void vunmap_pte_range(pmd_t *pmd, unsigned long addr, 
unsigned long end)
        do {
                pte_t ptent = ptep_get_and_clear(&init_mm, addr, pte);
                WARN_ON(!pte_none(ptent) && !pte_present(ptent));
-       } while (pte++, addr += PAGE_SIZE, addr != end);
+       } while (pte++, addr += PAGE_SIZE, addr < end && addr >= PAGE_SIZE);
 }
 
 static void vunmap_pmd_range(pud_t *pud, unsigned long addr, unsigned long end)
@@ -108,6 +108,9 @@ static void vunmap_page_range(unsigned long addr, unsigned 
long end)
        unsigned long next;
 
        BUG_ON(addr >= end);
+       WARN_ON(!PAGE_ALIGNED(addr) || !PAGE_ALIGNED(end));
+
+       addr = round_down(addr, PAGE_SIZE);
        pgd = pgd_offset_k(addr);
        do {
                next = pgd_addr_end(addr, end);
@@ -139,7 +142,7 @@ static int vmap_pte_range(pmd_t *pmd, unsigned long addr,
                        return -ENOMEM;
                set_pte_at(&init_mm, addr, pte, mk_pte(page, prot));
                (*nr)++;
-       } while (pte++, addr += PAGE_SIZE, addr != end);
+       } while (pte++, addr += PAGE_SIZE, addr < end);
        return 0;
 }
 
@@ -193,6 +196,8 @@ static int vmap_page_range_noflush(unsigned long start, 
unsigned long end,
        int nr = 0;
 
        BUG_ON(addr >= end);
+       BUG_ON(!PAGE_ALIGNED(addr) || !PAGE_ALIGNED(end));
+
        pgd = pgd_offset_k(addr);
        do {
                next = pgd_addr_end(addr, end);
-- 
1.9.1

Reply via email to