__vmap_pages_range_noflush() expects a non-empty, page-aligned [addr, end) range but does not check it.
An empty range dies in the BUG_ON(addr >= end) of vmap_small_pages_range_noflush() on the small-page path, while the huge-page path maps nothing and returns 0. An unaligned range is caught by vmap_pages_pte_range() on the small-page path, but the huge-page path misses it, because its chunks are always page-aligned, so the check in vmap_pte_range() passes, and the mapping just starts at the page boundary below addr. Check both at the entry of __vmap_pages_range_noflush() and return -EINVAL. Reported-by: Sashiko <[email protected]> Signed-off-by: Hao Ge <[email protected]> --- mm/vmalloc.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/mm/vmalloc.c b/mm/vmalloc.c index c0f33392c6ad..4d74144dfaff 100644 --- a/mm/vmalloc.c +++ b/mm/vmalloc.c @@ -698,6 +698,12 @@ int __vmap_pages_range_noflush(unsigned long addr, unsigned long end, { unsigned int i, nr = (end - addr) >> PAGE_SHIFT; + if (WARN_ON_ONCE(addr >= end)) + return -EINVAL; + + if (WARN_ON_ONCE(!PAGE_ALIGNED(addr) || !PAGE_ALIGNED(end))) + return -EINVAL; + if (WARN_ON_ONCE(page_shift < PAGE_SHIFT)) return -EINVAL; -- 2.25.1
