Skip to content

Commit dd7ef7b

Browse files
Qian Caitorvalds
Qian Cai
authored andcommitted
mm/compaction.c: fix an undefined behaviour
In a low-memory situation, cc->fast_search_fail can keep increasing as it is unable to find an available page to isolate in fast_isolate_freepages(). As the result, it could trigger an error below, so just compare with the maximum bits can be shifted first. UBSAN: Undefined behaviour in mm/compaction.c:1160:30 shift exponent 64 is too large for 64-bit type 'unsigned long' CPU: 131 PID: 1308 Comm: kcompactd1 Kdump: loaded Tainted: G W L 5.0.0+ #17 Call trace: dump_backtrace+0x0/0x450 show_stack+0x20/0x2c dump_stack+0xc8/0x14c __ubsan_handle_shift_out_of_bounds+0x7e8/0x8c4 compaction_alloc+0x2344/0x2484 unmap_and_move+0xdc/0x1dbc migrate_pages+0x274/0x1310 compact_zone+0x26ec/0x43bc kcompactd+0x15b8/0x1a24 kthread+0x374/0x390 ret_from_fork+0x10/0x18 [akpm@linux-foundation.org: code cleanup] Link: http://lkml.kernel.org/r/20190320203338.53367-1-cai@lca.pw Fixes: 70b4459 ("mm, compaction: use free lists to quickly locate a migration source") Signed-off-by: Qian Cai <cai@lca.pw> Acked-by: Vlastimil Babka <vbabka@suse.cz> Acked-by: Mel Gorman <mgorman@techsingularity.net> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
1 parent d3ba3ae commit dd7ef7b

File tree

1 file changed

+3
-1
lines changed

1 file changed

+3
-1
lines changed

mm/compaction.c

+3-1
Original file line numberDiff line numberDiff line change
@@ -1164,7 +1164,9 @@ static bool suitable_migration_target(struct compact_control *cc,
11641164
static inline unsigned int
11651165
freelist_scan_limit(struct compact_control *cc)
11661166
{
1167-
return (COMPACT_CLUSTER_MAX >> cc->fast_search_fail) + 1;
1167+
unsigned short shift = BITS_PER_LONG - 1;
1168+
1169+
return (COMPACT_CLUSTER_MAX >> min(shift, cc->fast_search_fail)) + 1;
11681170
}
11691171

11701172
/*

0 commit comments

Comments
 (0)