Commit f1af98c7629a1b76fd7336decbc776acdeed2120
Committed by
H. Peter Anvin
H. Peter Anvin
1 parent
1d931264af
Exists in
master
and in
20 other branches
memblock: Fix wraparound in find_region()
When trying to find huge range for crashkernel, get [ 0.000000] ------------[ cut here ]------------ [ 0.000000] WARNING: at arch/x86/mm/memblock.c:248 memblock_x86_reserve_range+0x40/0x7a() [ 0.000000] Hardware name: Sun Fire x4800 [ 0.000000] memblock_x86_reserve_range: wrong range [0xffffffff37000000, 0x137000000) [ 0.000000] Modules linked in: [ 0.000000] Pid: 0, comm: swapper Not tainted 2.6.36-rc5-tip-yh-01876-g1cac214-dirty #59 [ 0.000000] Call Trace: [ 0.000000] [<ffffffff82816f7e>] ? memblock_x86_reserve_range+0x40/0x7a [ 0.000000] [<ffffffff81078c2d>] warn_slowpath_common+0x85/0x9e [ 0.000000] [<ffffffff81078d38>] warn_slowpath_fmt+0x6e/0x70 [ 0.000000] [<ffffffff8281e77c>] ? memblock_find_region+0x40/0x78 [ 0.000000] [<ffffffff8281eb1f>] ? memblock_find_base+0x9a/0xb9 [ 0.000000] [<ffffffff82816f7e>] memblock_x86_reserve_range+0x40/0x7a [ 0.000000] [<ffffffff8280452c>] setup_arch+0x99d/0xb2a [ 0.000000] [<ffffffff810a3e02>] ? trace_hardirqs_off+0xd/0xf [ 0.000000] [<ffffffff81cec7d8>] ? _raw_spin_unlock_irqrestore+0x3d/0x4c [ 0.000000] [<ffffffff827ffcec>] start_kernel+0xde/0x3f1 [ 0.000000] [<ffffffff827ff2d4>] x86_64_start_reservations+0xa0/0xa4 [ 0.000000] [<ffffffff827ff3de>] x86_64_start_kernel+0x106/0x10d [ 0.000000] ---[ end trace a7919e7f17c0a725 ]--- [ 0.000000] Reserving 8192MB of memory at 17592186041200MB for crashkernel (System RAM: 526336MB) This is caused by a wraparound in the test due to size > end; explicitly check for this condition and fail. Signed-off-by: Yinghai Lu <yinghai@kernel.org> LKML-Reference: <4CAA4DD3.1080401@kernel.org> Signed-off-by: H. Peter Anvin <hpa@zytor.com>
Showing 1 changed file with 6 additions and 1 deletions Side-by-side Diff
mm/memblock.c
| ... | ... | @@ -105,13 +105,18 @@ |
| 105 | 105 | phys_addr_t base, res_base; |
| 106 | 106 | long j; |
| 107 | 107 | |
| 108 | + /* In case, huge size is requested */ | |
| 109 | + if (end < size) | |
| 110 | + return MEMBLOCK_ERROR; | |
| 111 | + | |
| 112 | + base = memblock_align_down((end - size), align); | |
| 113 | + | |
| 108 | 114 | /* Prevent allocations returning 0 as it's also used to |
| 109 | 115 | * indicate an allocation failure |
| 110 | 116 | */ |
| 111 | 117 | if (start == 0) |
| 112 | 118 | start = PAGE_SIZE; |
| 113 | 119 | |
| 114 | - base = memblock_align_down((end - size), align); | |
| 115 | 120 | while (start <= base) { |
| 116 | 121 | j = memblock_overlaps_region(&memblock.reserved, base, size); |
| 117 | 122 | if (j < 0) |