Messages in this thread | | | Date | Thu, 17 Apr 2008 23:28:43 +0530 | From | "Aneesh Kumar K.V" <> | Subject | Re: [PATCH] mballoc: fix hot spins after err_freebuddy and err_freemeta |
| |
On Thu, Apr 17, 2008 at 06:09:14PM +0200, Roel Kluin wrote: > ext4_mb_init_backend() has a variable i of type ext4_group_t. which is typedefined > in include/linux/ext4_fs_i.h:34 to unsigned long. Since unsigned, i >= 0 is always > true, so fix hot spins after err_freebuddy and err_freemeta. > > Signed-off-by: Roel Kluin <12o3l@tiscali.nl> > --- > diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c > index ef97f19..afba9b8 100644 > --- a/fs/ext4/mballoc.c > +++ b/fs/ext4/mballoc.c > @@ -2618,14 +2618,14 @@ static int ext4_mb_init_backend(struct super_block *sb) > return 0;
The function needs more changes. For ex:
2279 if (meta_group_info[j] == NULL) { 2280 printk(KERN_ERR "EXT4-fs: can't allocate buddy mem\n"); 2281 i--; 2282 goto err_freebuddy; 2283 }
That decrement i--; could result in bad value if i == 0;.
> > err_freebuddy: > - while (i >= 0) { > + do { > kfree(ext4_get_group_info(sb, i)); > - i--; > - } > - i = num_meta_group_infos; > + } while (i-- != 0); > + i = num_meta_group_infos - 1; > err_freemeta: > - while (--i >= 0) > + do { > kfree(sbi->s_group_info[i]); > + } while (i-- != 0); > iput(sbi->s_buddy_cache); > err_freesgi: > kfree(sbi->s_group_info);
-aneesh
| |