[PATCH v3 06/10] mm/vmalloc: reject empty and unaligned ranges in __vmap_pages_range_noflush()

From: Hao Ge

Date: Mon Oct 26 2026 - 04:04:03 EST


__vmap_pages_range_noflush() expects a non-empty, page-aligned
[addr, end) range but does not check it.

An empty range dies in the BUG_ON(addr >= end) of
vmap_small_pages_range_noflush() on the small-page path, while the
huge-page path maps nothing and returns 0.

An unaligned range is caught by vmap_pages_pte_range() on the
small-page path, but the huge-page path misses it, because its
chunks are always page-aligned, so the check in vmap_pte_range()
passes, and the mapping just starts at the page boundary below addr.

Check both at the entry of __vmap_pages_range_noflush() and return
-EINVAL.

Reported-by: Sashiko <sashiko-bot@xxxxxxxxxx>
Signed-off-by: Hao Ge <hao.ge@xxxxxxxxx>
---
mm/vmalloc.c | 6 ++++++
1 file changed, 6 insertions(+)

diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index c0f33392c6ad..4d74144dfaff 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -698,6 +698,12 @@ int __vmap_pages_range_noflush(unsigned long addr, unsigned long end,
{
unsigned int i, nr = (end - addr) >> PAGE_SHIFT;

+ if (WARN_ON_ONCE(addr >= end))
+ return -EINVAL;
+
+ if (WARN_ON_ONCE(!PAGE_ALIGNED(addr) || !PAGE_ALIGNED(end)))
+ return -EINVAL;
+
if (WARN_ON_ONCE(page_shift < PAGE_SHIFT))
return -EINVAL;

--
2.25.1