path: root/mm
diff options
authorMel Gorman <>2021-06-24 18:40:07 -0700
committerLinus Torvalds <>2021-06-24 19:40:54 -0700
commitb3b64ebd38225d8032b5db42938d969b602040c2 (patch)
treec5002be80ee46f6ee3e49e1c34a3ed5c3dc2458a /mm
parentb08e50dd64489e3997029d204f761cb57a3762d2 (diff)
mm/page_alloc: do bulk array bounds check after checking populated elements
Dan Carpenter reported the following The patch 0f87d9d30f21: "mm/page_alloc: add an array-based interface to the bulk page allocator" from Apr 29, 2021, leads to the following static checker warning: mm/page_alloc.c:5338 __alloc_pages_bulk() warn: potentially one past the end of array 'page_array[nr_populated]' The problem can occur if an array is passed in that is fully populated. That potentially ends up allocating a single page and storing it past the end of the array. This patch returns 0 if the array is fully populated. Link: Fixes: 0f87d9d30f21 ("mm/page_alloc: add an array-based interface to the bulk page allocator") Signed-off-by: Mel Gorman <> Reported-by: Dan Carpenter <> Cc: Jesper Dangaard Brouer <> Cc: Vlastimil Babka <> Signed-off-by: Andrew Morton <> Signed-off-by: Linus Torvalds <>
Diffstat (limited to 'mm')
1 files changed, 4 insertions, 0 deletions
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 7124bb00219d..ef2265f86b91 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -5056,6 +5056,10 @@ unsigned long __alloc_pages_bulk(gfp_t gfp, int preferred_nid,
while (page_array && nr_populated < nr_pages && page_array[nr_populated])
+ /* Already populated array? */
+ if (unlikely(page_array && nr_pages - nr_populated == 0))
+ return 0;
/* Use the single page allocator for one page. */
if (nr_pages - nr_populated == 1)
goto failed;