the __get_vm_area_node() doesn't check the parameter start and end.
__get_vm_area_node() called by __get_vm_area(), its a export function.
If some drivers pass a bad value to start, such as 0. it will
something wrong with vmlist.
static struct vm_struct *
__get_vm_area_node(unsigned long size, unsigned long flags, unsigned long start,
unsigned long end, int node, gfp_t gfp_mask, void *caller)
{
...
write_lock(&vmlist_lock);
for (p = &vmlist; (tmp = *p) != NULL ;p = &tmp->next) {
if ((unsigned long)tmp->addr < addr) {
if((unsigned long)tmp->addr + tmp->size >= addr)
addr = ALIGN(tmp->size +
(unsigned long)tmp->addr, align);
continue;
}
if ((size + addr) < addr)
goto out;
if (size + addr <= (unsigned long)tmp->addr) // if
addr is 0, the loop will be immediately break.
goto found;
addr = ALIGN(tmp->size + (unsigned long)tmp->addr, align);
if (addr > end - size)
goto out;
}
if ((size + addr) < addr)
goto out;
if (addr > end - size)
goto out;
// if addr is 0, it will be add a trash vm_struct to vmlist.
found:
area->next = *p;
*p = area;
area->flags = flags;
area->addr = (void *)addr;
area->size = size;
area->pages = NULL;
area->nr_pages = 0;
area->phys_addr = 0;
area->caller = caller;
write_unlock(&vmlist_lock);
return area;
...
}
I don't kown, weather it's a bug.
If it's a bug, my patch is:
--- linux-2.6.27.orig/mm/vmalloc.c 2008-11-11 00:22:28.000000000 +0800
+++ linux-2.6.27/mm/vmalloc.c 2008-11-11 00:28:31.000000000 +0800
@@ -214,6 +214,9 @@ __get_vm_area_node(unsigned long size, u
unsigned long align = 1;
unsigned long addr;
+ if (start < VMALLOC_START || end > VMALLOC_END)
+ return NULL;
+
BUG_ON(in_interrupt());
if (flags & VM_IOREMAP) {
int bit = fls(size);