[ Upstream commit 8c43004af01635cc9fbb11031d070e5e0d327ef2 ]
pcpu_find_block_fit() guarantees that a fit is found within PCPU_BITMAP_BLOCK_BITS. Iteration is used to determine the first fit as it compares against the block's contig_hint. This can lead to incorrectly scanning past the end of the bitmap. The behavior was okay given the check after for bit_off >= end and the correctness of the hints from pcpu_find_block_fit().
This patch fixes this by bounding the end offset by the number of bits in a chunk.
Signed-off-by: Dennis Zhou dennis@kernel.org Reviewed-by: Peng Fan peng.fan@nxp.com Signed-off-by: Sasha Levin sashal@kernel.org --- mm/percpu.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/mm/percpu.c b/mm/percpu.c index bc58bcbe4b60..9beb84800d8d 100644 --- a/mm/percpu.c +++ b/mm/percpu.c @@ -984,7 +984,8 @@ static int pcpu_alloc_area(struct pcpu_chunk *chunk, int alloc_bits, /* * Search to find a fit. */ - end = start + alloc_bits + PCPU_BITMAP_BLOCK_BITS; + end = min_t(int, start + alloc_bits + PCPU_BITMAP_BLOCK_BITS, + pcpu_chunk_map_bits(chunk)); bit_off = bitmap_find_next_zero_area(chunk->alloc_map, end, start, alloc_bits, align_mask); if (bit_off >= end)