[PATCH v3 03/10] mm/vmalloc: clamp an unaligned range in vunmap_pte_range()

[Hao Ge]

commit a739e6b557af ("mm: vmalloc: WARN_ON if mapping size is not
PAGE_SIZE aligned") made vmap_pte_range() warn and bail out when the
size is not a multiple of PAGE_SIZE. That loop steps in page
multiples and stops only at addr == end; with an unaligned size addr
never lands on end, so the loop cannot terminate and walks off the
end of the page table.

vunmap_pte_range() has the same loop without any guard, so an
unaligned range would clear PTEs past end without ever stopping,
walking off the end of the page table.

Add the check there too. The range is clamped down to the last full
page rather than dropped, and the loop is skipped when nothing is
left, so a buggy caller still gets its PTEs cleared as far as they
go.

Reported-by: Sashiko <sashiko-bot@xxxxxxxxxx>
Signed-off-by: Hao Ge <hao.ge@xxxxxxxxx>
---
 mm/vmalloc.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index 44e0eb32708f..7131f60d1a8e 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -393,6 +393,11 @@ static void vunmap_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end,
 	pte_t ptent;
 	unsigned long size = PAGE_SIZE;
 
+	if (WARN_ON_ONCE(!PAGE_ALIGNED(end - addr)))
+		end = addr + PAGE_ALIGN_DOWN(end - addr);
+	if (end == addr)
+		return;
+
 	pte = pte_offset_kernel(pmd, addr);
 	lazy_mmu_mode_enable();
 
-- 
2.25.1