vmalloc: Fix NULL pointer dereference in is_vm_area_hugepages()

[PATCH] vmalloc: Fix NULL pointer dereference in is_vm_area_hugepages()

Posted by Hui Zhu 1 week, 3 days ago

From: Hui Zhu <zhuhui@kylinos.cn>

find_vm_area() can return NULL if the given address is not a valid
vmalloc area. Check the return value before dereferencing it to avoid
a kernel crash.

Fixes: 121e6f3258fe ("mm/vmalloc: hugepage vmalloc mappings")
Signed-off-by: Hui Zhu <zhuhui@kylinos.cn>
---
 include/linux/vmalloc.h | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/include/linux/vmalloc.h b/include/linux/vmalloc.h
index 3b02c0c6b371..d87dc7f77f4e 100644
--- a/include/linux/vmalloc.h
+++ b/include/linux/vmalloc.h
@@ -265,7 +265,9 @@ static inline bool is_vm_area_hugepages(const void *addr)
 	 * allocated in the vmalloc layer.
 	 */
 #ifdef CONFIG_HAVE_ARCH_HUGE_VMALLOC
-	return find_vm_area(addr)->page_order > 0;
+	struct vm_struct *area = find_vm_area(addr);
+
+	return area && area->page_order > 0;
 #else
 	return false;
 #endif
-- 
2.43.0

Re: [PATCH] vmalloc: Fix NULL pointer dereference in is_vm_area_hugepages()

Posted by Dev Jain 1 week, 3 days ago


On 29/05/26 7:11 am, Hui Zhu wrote:
> From: Hui Zhu <zhuhui@kylinos.cn>
> 
> find_vm_area() can return NULL if the given address is not a valid
> vmalloc area. Check the return value before dereferencing it to avoid
> a kernel crash.
> 
> Fixes: 121e6f3258fe ("mm/vmalloc: hugepage vmalloc mappings")
> Signed-off-by: Hui Zhu <zhuhui@kylinos.cn>
> ---

I think this makes sense from API PoV.

Reviewed-by: Dev Jain <dev.jain@arm.com>

>  include/linux/vmalloc.h | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/include/linux/vmalloc.h b/include/linux/vmalloc.h
> index 3b02c0c6b371..d87dc7f77f4e 100644
> --- a/include/linux/vmalloc.h
> +++ b/include/linux/vmalloc.h
> @@ -265,7 +265,9 @@ static inline bool is_vm_area_hugepages(const void *addr)
>  	 * allocated in the vmalloc layer.
>  	 */
>  #ifdef CONFIG_HAVE_ARCH_HUGE_VMALLOC
> -	return find_vm_area(addr)->page_order > 0;
> +	struct vm_struct *area = find_vm_area(addr);
> +
> +	return area && area->page_order > 0;
>  #else
>  	return false;
>  #endif

Re: [PATCH] vmalloc: Fix NULL pointer dereference in is_vm_area_hugepages()

Posted by Uladzislau Rezki 1 week ago

On Fri, May 29, 2026 at 10:24:12AM +0530, Dev Jain wrote:
> 
> 
> On 29/05/26 7:11 am, Hui Zhu wrote:
> > From: Hui Zhu <zhuhui@kylinos.cn>
> > 
> > find_vm_area() can return NULL if the given address is not a valid
> > vmalloc area. Check the return value before dereferencing it to avoid
> > a kernel crash.
> > 
> > Fixes: 121e6f3258fe ("mm/vmalloc: hugepage vmalloc mappings")
> > Signed-off-by: Hui Zhu <zhuhui@kylinos.cn>
> > ---
> 
> I think this makes sense from API PoV.
> 
> Reviewed-by: Dev Jain <dev.jain@arm.com>
> 
Reviewed-by: Uladzislau Rezki (Sony) <urezki@gmail.com>

--
Uladzislau Rezki