| Message ID | 20210318155955.18220-1-colin.king@canonical.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | [next] mm/vmalloc: fix read of uninitialized pointer area | expand |
Excerpts from Colin King's message of March 19, 2021 1:59 am: > From: Colin Ian King <colin.king@canonical.com> > > There is a corner case where the sanity check of variable size fails > and branches to label fail and shift can be less than PAGE_SHIFT > causing area to never be assigned. This was picked up by static > analysis as follows: > > 1. var_decl: Declaring variable area without initializer. > struct vm_struct *area; > > ... > > 2. Condition !size, taking true branch. > if (!size || (size >> PAGE_SHIFT) > totalram_pages()) > 3. Jumping to label fail. > goto fail; > > ... > > 4. Condition shift > 12, taking false branch. > fail: > if (shift > PAGE_SHIFT) { > shift = PAGE_SHIFT; > align = real_align; > size = real_size; > goto again; > } > > Uninitialized pointer read (UNINIT) > 5. uninit_use: Using uninitialized value area. > if (!area) { > ... > } > > Fix this by setting area to NULL to avoid the uninitialized read > of area. > > Addresses-Coverity: ("Uninitialized pointer read") > Fixes: 92db9fec381b ("mm/vmalloc: hugepage vmalloc mappings") > Signed-off-by: Colin Ian King <colin.king@canonical.com> Looks good to me. Acked-by: Nicholas Piggin <npiggin@gmail.com> Thanks, Nick > --- > mm/vmalloc.c | 4 +++- > 1 file changed, 3 insertions(+), 1 deletion(-) > > diff --git a/mm/vmalloc.c b/mm/vmalloc.c > index 96444d64129a..4b415b4bb7ae 100644 > --- a/mm/vmalloc.c > +++ b/mm/vmalloc.c > @@ -2888,8 +2888,10 @@ void *__vmalloc_node_range(unsigned long size, unsigned long align, > unsigned long real_align = align; > unsigned int shift = PAGE_SHIFT; > > - if (!size || (size >> PAGE_SHIFT) > totalram_pages()) > + if (!size || (size >> PAGE_SHIFT) > totalram_pages()) { > + area = NULL; > goto fail; > + } > > if (vmap_allow_huge && !(vm_flags & VM_NO_HUGE_VMAP) && > arch_vmap_pmd_supported(prot)) { > -- > 2.30.2 > >
diff --git a/mm/vmalloc.c b/mm/vmalloc.c index 96444d64129a..4b415b4bb7ae 100644 --- a/mm/vmalloc.c +++ b/mm/vmalloc.c @@ -2888,8 +2888,10 @@ void *__vmalloc_node_range(unsigned long size, unsigned long align, unsigned long real_align = align; unsigned int shift = PAGE_SHIFT; - if (!size || (size >> PAGE_SHIFT) > totalram_pages()) + if (!size || (size >> PAGE_SHIFT) > totalram_pages()) { + area = NULL; goto fail; + } if (vmap_allow_huge && !(vm_flags & VM_NO_HUGE_VMAP) && arch_vmap_pmd_supported(prot)) {