The pte loop of vmap_pages_pte_range() maps whole pages and stops only when addr lands exactly on end. An unaligned end lets addr jump over it and the loop keeps mapping into whatever follows the range. An unaligned start maps the page below the range with its first pte. That corruption is impossible to debug afterwards, so bug out on addr and end at the entry of vmap_pages_range_noflush_walk().
Reported-by: Sashiko <[email protected]> Signed-off-by: Hao Ge <[email protected]> --- mm/vmalloc.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/mm/vmalloc.c b/mm/vmalloc.c index 27f2674a5556..86fbb1d2b27a 100644 --- a/mm/vmalloc.c +++ b/mm/vmalloc.c @@ -698,6 +698,8 @@ static int vmap_pages_range_noflush_walk(unsigned long addr, unsigned long end, pgtbl_mod_mask mask = 0; BUG_ON(addr >= end); + BUG_ON(!PAGE_ALIGNED(addr) || !PAGE_ALIGNED(end)); + pgd = pgd_offset_k(addr); do { next = pgd_addr_end(addr, end); -- 2.25.1
