Re: [PATCH] mm: fix a overflow in test_pages_in_a_zone()

["Kani, Toshimitsu" <toshi.kani@hpe.com>]

On Tue, 2017-02-07 at 19:34 +0800, zhongjiang wrote:
> From: zhong jiang <zhongjiang@huawei.com>
> 
> when the mailline introduce the commit a96dfddbcc04
> ("base/memory, hotplug: fix a kernel oops in show_valid_zones()"),
> it obtains the valid start and end pfn from the given pfn range.
> The valid start pfn can fix the actual issue, but it introduce
> another issue. The valid end pfn will may exceed the given end_pfn.
> 
> Ahthough the incorrect overflow will not result in actual problem
> at present, but I think it need to be fixed.

Yes, test_pages_in_a_zone() assumes that end_pfn is aligned by
MAX_ORDER_NR_PAGES.  This is true for both callers, show_valid_zones()
and __offline_pages().  I did not introduce this assumption. :-)

As you pointed out, it is prudent to remove this assumption for future
usages.  In this case, I think we need the following change as well.

diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
index a40c0c2..09c8b99 100644
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
@@ -1513,7 +1513,7 @@ int test_pages_in_a_zone(unsigned long start_pfn,
unsigned long end_pfn,
                while ((i < MAX_ORDER_NR_PAGES) &&
                        !pfn_valid_within(pfn + i))
                        i++;
-               if (i == MAX_ORDER_NR_PAGES)
+               if ((i == MAX_ORDER_NR_PAGES) || (pfn + i >= end_pfn))
                        continue;
                page = pfn_to_page(pfn + i);
                if (zone && page_zone(page) != zone)


Thanks,
-Toshi