Skip to content
  • Michal Hocko's avatar
    mm: do not bug_on on incorrect length in __mm_populate() · 81ebc9de
    Michal Hocko authored
    commit bb177a73 upstream.
    
    syzbot has noticed that a specially crafted library can easily hit
    VM_BUG_ON in __mm_populate
    
      kernel BUG at mm/gup.c:1242!
      invalid opcode: 0000 [#1] SMP
      CPU: 2 PID: 9667 Comm: a.out Not tainted 4.18.0-rc3 #644
      Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 05/19/2017
      RIP: 0010:__mm_populate+0x1e2/0x1f0
      Code: 55 d0 65 48 33 14 25 28 00 00 00 89 d8 75 21 48 83 c4 20 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 75 18 f1 ff 0f 0b e8 6e 18 f1 ff <0f> 0b 31 db eb c9 e8 93 06 e0 ff 0f 1f 00 55 48 89 e5 53 48 89 fb
      Call Trace:
         vm_brk_flags+0xc3/0x100
         vm_brk+0x1f/0x30
         load_elf_library+0x281/0x2e0
         __ia32_sys_uselib+0x170/0x1e0
         do_fast_syscall_32+0xca/0x420
         entry_SYSENTER_compat+0x70/0x7f
    
    The reason is that the length of the new brk is not page aligned when we
    try to populate the it.  There is no reason to bug on that...
    81ebc9de