On Tue, Nov 10, 2026 at 07:25:40PM +0800, Hao Ge wrote:
> commit a739e6b557af ("mm: vmalloc: WARN_ON if mapping size is not
> PAGE_SIZE aligned") put the check in vmap_pte_range(), which is too
> late, because the upper levels may already have installed page
> tables for a range that is rejected anyway.
>
> The pte loop maps whole pages and stops only when addr lands
> exactly on end. An unaligned end lets addr jump over it and the
> loop keeps mapping past the range. An unaligned start maps the
> page below the range and usually misses end too. Such a range is
> never a legitimate request, and the corruption it leaves behind is
> hard to attribute to the caller afterwards, so bug out on addr and
> end at the entry of vmap_range_noflush() and drop the check from
> vmap_pte_range().
>
> Signed-off-by: Hao Ge <[email protected]>
> ---
> mm/vmalloc.c | 4 +---
> 1 file changed, 1 insertion(+), 3 deletions(-)
>
> diff --git a/mm/vmalloc.c b/mm/vmalloc.c
> index 093b8d5f7b0e..27f2674a5556 100644
> --- a/mm/vmalloc.c
> +++ b/mm/vmalloc.c
> @@ -125,9 +125,6 @@ static int vmap_pte_range(pmd_t *pmd, unsigned long addr,
> unsigned long end,
> unsigned long size;
> unsigned int nr_pages;
>
> - if (WARN_ON_ONCE(!PAGE_ALIGNED(end - addr)))
> - return -EINVAL;
> -
> pfn = phys_addr >> PAGE_SHIFT;
> pte = pte_alloc_kernel_track(pmd, addr, mask);
> if (!pte)
> @@ -347,6 +344,7 @@ static int vmap_range_noflush(unsigned long addr,
> unsigned long end,
> */
> might_sleep();
> BUG_ON(addr >= end);
> + BUG_ON(!PAGE_ALIGNED(addr) || !PAGE_ALIGNED(end));
>
> start = addr;
> pgd = pgd_offset_k(addr);
> --
> 2.25.1
>
Like Suren proposed, there is only one user of vmap_range_noflush() it
is vmap_page_range() function. You can add warn-on-once() there and
bail out.
Do not add BUG_ON().
--
Uladzislau Rezki
