Revision 36845663843fc59c5d794e3dc0641472e3e572da authored by Huang Shijie on 29 December 2020, 23:14:58 UTC, committed by Linus Torvalds on 29 December 2020, 23:36:49 UTC
Some graphic card has very big memory on chip, such as 32G bytes.
In the following case, it will cause overflow:
pool = gen_pool_create(PAGE_SHIFT, NUMA_NO_NODE);
ret = gen_pool_add(pool, 0x1000000, SZ_32G, NUMA_NO_NODE);
va = gen_pool_alloc(pool, SZ_4G);
The overflow occurs in gen_pool_alloc_algo_owner():
....
size = nbits << order;
....
The @nbits is "int" type, so it will overflow.
Then the gen_pool_avail() will return the wrong value.
This patch converts some "int" to "unsigned long", and
changes the compare code in while.
Link: https://lkml.kernel.org/r/20201229060657.3389-1-sjhuang@iluvatar.ai
Signed-off-by: Huang Shijie <sjhuang@iluvatar.ai>
Reported-by: Shi Jiasheng <jiasheng.shi@iluvatar.ai>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
1 parent aa8c7db
| File | Mode | Size |
|---|---|---|
| kasan | ||
| Kconfig | -rw-r--r-- | 28.1 KB |
| Kconfig.debug | -rw-r--r-- | 5.6 KB |
| Makefile | -rw-r--r-- | 4.3 KB |
| backing-dev.c | -rw-r--r-- | 25.2 KB |
| balloon_compaction.c | -rw-r--r-- | 8.2 KB |
| cleancache.c | -rw-r--r-- | 9.8 KB |
| cma.c | -rw-r--r-- | 14.2 KB |
| cma.h | -rw-r--r-- | 646 bytes |
| cma_debug.c | -rw-r--r-- | 4.5 KB |
| compaction.c | -rw-r--r-- | 81.2 KB |
| debug.c | -rw-r--r-- | 8.5 KB |
| debug_page_ref.c | -rw-r--r-- | 1.4 KB |
| debug_vm_pgtable.c | -rw-r--r-- | 29.0 KB |
| dmapool.c | -rw-r--r-- | 13.7 KB |
| early_ioremap.c | -rw-r--r-- | 6.8 KB |
| fadvise.c | -rw-r--r-- | 5.3 KB |
| failslab.c | -rw-r--r-- | 1.4 KB |
| filemap.c | -rw-r--r-- | 100.7 KB |
| frame_vector.c | -rw-r--r-- | 6.4 KB |
| frontswap.c | -rw-r--r-- | 14.2 KB |
| gup.c | -rw-r--r-- | 81.1 KB |
| gup_test.c | -rw-r--r-- | 5.4 KB |
| gup_test.h | -rw-r--r-- | 915 bytes |
| highmem.c | -rw-r--r-- | 19.2 KB |
| hmm.c | -rw-r--r-- | 16.6 KB |
| huge_memory.c | -rw-r--r-- | 82.6 KB |
| hugetlb.c | -rw-r--r-- | 155.1 KB |
| hugetlb_cgroup.c | -rw-r--r-- | 21.4 KB |
| hwpoison-inject.c | -rw-r--r-- | 2.6 KB |
| init-mm.c | -rw-r--r-- | 1.3 KB |
| internal.h | -rw-r--r-- | 19.3 KB |
| interval_tree.c | -rw-r--r-- | 3.1 KB |
| ioremap.c | -rw-r--r-- | 6.5 KB |
| khugepaged.c | -rw-r--r-- | 58.7 KB |
| kmemleak.c | -rw-r--r-- | 56.2 KB |
| ksm.c | -rw-r--r-- | 88.8 KB |
| list_lru.c | -rw-r--r-- | 14.3 KB |
| maccess.c | -rw-r--r-- | 8.7 KB |
| madvise.c | -rw-r--r-- | 30.5 KB |
| mapping_dirty_helpers.c | -rw-r--r-- | 10.5 KB |
| memblock.c | -rw-r--r-- | 60.2 KB |
| memcontrol.c | -rw-r--r-- | 190.3 KB |
| memfd.c | -rw-r--r-- | 7.9 KB |
| memory-failure.c | -rw-r--r-- | 52.2 KB |
| memory.c | -rw-r--r-- | 141.5 KB |
| memory_hotplug.c | -rw-r--r-- | 50.7 KB |
| mempolicy.c | -rw-r--r-- | 76.1 KB |
| mempool.c | -rw-r--r-- | 15.8 KB |
| memremap.c | -rw-r--r-- | 14.0 KB |
| memtest.c | -rw-r--r-- | 2.8 KB |
| migrate.c | -rw-r--r-- | 81.9 KB |
| mincore.c | -rw-r--r-- | 7.0 KB |
| mlock.c | -rw-r--r-- | 22.2 KB |
| mm_init.c | -rw-r--r-- | 5.3 KB |
| mmap.c | -rw-r--r-- | 103.0 KB |
| mmap_lock.c | -rw-r--r-- | 5.8 KB |
| mmu_gather.c | -rw-r--r-- | 8.4 KB |
| mmu_notifier.c | -rw-r--r-- | 34.3 KB |
| mmzone.c | -rw-r--r-- | 2.2 KB |
| mprotect.c | -rw-r--r-- | 17.3 KB |
| mremap.c | -rw-r--r-- | 25.7 KB |
| msync.c | -rw-r--r-- | 2.6 KB |
| nommu.c | -rw-r--r-- | 44.8 KB |
| oom_kill.c | -rw-r--r-- | 30.4 KB |
| page-writeback.c | -rw-r--r-- | 84.6 KB |
| page_alloc.c | -rw-r--r-- | 248.9 KB |
| page_counter.c | -rw-r--r-- | 6.6 KB |
| page_ext.c | -rw-r--r-- | 10.9 KB |
| page_idle.c | -rw-r--r-- | 5.3 KB |
| page_io.c | -rw-r--r-- | 11.6 KB |
| page_isolation.c | -rw-r--r-- | 9.2 KB |
| page_owner.c | -rw-r--r-- | 16.3 KB |
| page_poison.c | -rw-r--r-- | 2.3 KB |
| page_reporting.c | -rw-r--r-- | 9.9 KB |
| page_reporting.h | -rw-r--r-- | 1.6 KB |
| page_vma_mapped.c | -rw-r--r-- | 7.8 KB |
| pagewalk.c | -rw-r--r-- | 14.2 KB |
| percpu-internal.h | -rw-r--r-- | 7.7 KB |
| percpu-km.c | -rw-r--r-- | 3.0 KB |
| percpu-stats.c | -rw-r--r-- | 6.0 KB |
| percpu-vm.c | -rw-r--r-- | 10.3 KB |
| percpu.c | -rw-r--r-- | 95.4 KB |
| pgalloc-track.h | -rw-r--r-- | 1.3 KB |
| pgtable-generic.c | -rw-r--r-- | 5.6 KB |
| process_vm_access.c | -rw-r--r-- | 8.2 KB |
| ptdump.c | -rw-r--r-- | 4.0 KB |
| readahead.c | -rw-r--r-- | 17.3 KB |
| rmap.c | -rw-r--r-- | 55.6 KB |
| rodata_test.c | -rw-r--r-- | 1.3 KB |
| shmem.c | -rw-r--r-- | 110.8 KB |
| shuffle.c | -rw-r--r-- | 4.7 KB |
| shuffle.h | -rw-r--r-- | 1.1 KB |
| slab.c | -rw-r--r-- | 105.2 KB |
| slab.h | -rw-r--r-- | 16.3 KB |
| slab_common.c | -rw-r--r-- | 29.3 KB |
| slob.c | -rw-r--r-- | 18.0 KB |
| slub.c | -rw-r--r-- | 140.8 KB |
| sparse-vmemmap.c | -rw-r--r-- | 6.8 KB |
| sparse.c | -rw-r--r-- | 26.4 KB |
| swap.c | -rw-r--r-- | 32.4 KB |
| swap_cgroup.c | -rw-r--r-- | 5.1 KB |
| swap_slots.c | -rw-r--r-- | 9.3 KB |
| swap_state.c | -rw-r--r-- | 24.9 KB |
| swapfile.c | -rw-r--r-- | 96.9 KB |
| truncate.c | -rw-r--r-- | 27.7 KB |
| usercopy.c | -rw-r--r-- | 9.5 KB |
| userfaultfd.c | -rw-r--r-- | 17.6 KB |
| util.c | -rw-r--r-- | 24.2 KB |
| vmacache.c | -rw-r--r-- | 2.7 KB |
| vmalloc.c | -rw-r--r-- | 91.4 KB |
| vmpressure.c | -rw-r--r-- | 13.9 KB |
| vmscan.c | -rw-r--r-- | 123.9 KB |
| vmstat.c | -rw-r--r-- | 52.9 KB |
| workingset.c | -rw-r--r-- | 21.3 KB |
| z3fold.c | -rw-r--r-- | 46.8 KB |
| zbud.c | -rw-r--r-- | 18.2 KB |
| zpool.c | -rw-r--r-- | 11.2 KB |
| zsmalloc.c | -rw-r--r-- | 61.0 KB |
| zswap.c | -rw-r--r-- | 38.3 KB |
Computing file changes ...
