mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2026-09-05 08:44:14 +02:00
Ye Liu
54cc9b3847
If the kernel command line includes "debug_guardpage_minorder" without an
equals sign (i.e., no value is provided), the early parameter parser
passes a NULL buf pointer to the setup function.
kstrtouint() does not perform a NULL check on its input and calls directly
into kstrtoull() which dereferences s[0] unconditionally, leading to a
NULL pointer dereference and early boot crash.
Additionally, the error path's pr_err("%s", buf) would also crash with a
NULL format argument.
Link: https://lore.kernel.org/20260806004556.2633049-1-ye.liu@linux.dev
Fixes: c0a32fc5a2 ("mm: more intensive memory corruption debugging")
Signed-off-by: Ye Liu <liuye@kylinos.cn>
Acked-by: Zi Yan <ziy@nvidia.com>
Reviewed-by: John Hubbard <jhubbard@nvidia.com>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Vlastimil Babka <vbabka@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
52 lines
1.4 KiB
C
52 lines
1.4 KiB
C
// SPDX-License-Identifier: GPL-2.0
|
|
#include <linux/mm.h>
|
|
#include <linux/page-isolation.h>
|
|
|
|
unsigned int _debug_guardpage_minorder;
|
|
|
|
bool _debug_pagealloc_enabled_early __read_mostly
|
|
= IS_ENABLED(CONFIG_DEBUG_PAGEALLOC_ENABLE_DEFAULT);
|
|
EXPORT_SYMBOL(_debug_pagealloc_enabled_early);
|
|
DEFINE_STATIC_KEY_FALSE(_debug_pagealloc_enabled);
|
|
EXPORT_SYMBOL(_debug_pagealloc_enabled);
|
|
|
|
DEFINE_STATIC_KEY_FALSE(_debug_guardpage_enabled);
|
|
|
|
static int __init early_debug_pagealloc(char *buf)
|
|
{
|
|
return kstrtobool(buf, &_debug_pagealloc_enabled_early);
|
|
}
|
|
early_param("debug_pagealloc", early_debug_pagealloc);
|
|
|
|
static int __init debug_guardpage_minorder_setup(char *buf)
|
|
{
|
|
unsigned int res;
|
|
|
|
if (!buf || kstrtouint(buf, 10, &res) < 0 || res > MAX_PAGE_ORDER / 2) {
|
|
pr_err("Bad debug_guardpage_minorder value: %s\n", buf ?: "(missing)");
|
|
return 0;
|
|
}
|
|
_debug_guardpage_minorder = res;
|
|
pr_info("Setting debug_guardpage_minorder to %u\n", res);
|
|
return 0;
|
|
}
|
|
early_param("debug_guardpage_minorder", debug_guardpage_minorder_setup);
|
|
|
|
bool __set_page_guard(struct zone *zone, struct page *page, unsigned int order)
|
|
{
|
|
if (order >= debug_guardpage_minorder())
|
|
return false;
|
|
|
|
__SetPageGuard(page);
|
|
INIT_LIST_HEAD(&page->buddy_list);
|
|
set_page_private(page, order);
|
|
|
|
return true;
|
|
}
|
|
|
|
void __clear_page_guard(struct zone *zone, struct page *page, unsigned int order)
|
|
{
|
|
__ClearPageGuard(page);
|
|
set_page_private(page, 0);
|
|
}
|