commit a739e6b557af ("mm: vmalloc: WARN_ON if mapping size is not
PAGE_SIZE aligned") made vmap_pte_range() warn and bail out when the
size is not a multiple of PAGE_SIZE. Its loop only stops at
addr == end and otherwise steps over it and maps over whatever
follows the page table. vmap_pages_pte_range() has the same kind of
loop but was never given the check.Add it there as a backstop. Reported-by: Sashiko <[email protected]> Signed-off-by: Hao Ge <[email protected]> --- mm/vmalloc.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/mm/vmalloc.c b/mm/vmalloc.c index d60b99b81ec9..c0f33392c6ad 100644 --- a/mm/vmalloc.c +++ b/mm/vmalloc.c @@ -557,6 +557,9 @@ static int vmap_pages_pte_range(pmd_t *pmd, unsigned long addr, int err = 0; pte_t *pte; + if (WARN_ON_ONCE(!PAGE_ALIGNED(end - addr))) + return -EINVAL; + /* * nr is a running index into the array which helps higher level * callers keep track of where we're up to. -- 2.25.1
