Messages in this thread Patch in this message | | | Date | Mon, 12 Jan 2009 17:26:58 -0800 | From | Greg KH <> | Subject | [patch 05/21] powerpc: Fix corruption error in rh_alloc_fixed() |
| |
2.6.27-stable review patch. If anyone has any objections, please let us know.
------------------
From: Guillaume Knispel <gknispel@proformatique.com>
commit af4d3643864ee5fcba0c97d77a424fa0b0346f8e upstream.
There is an error in rh_alloc_fixed() of the Remote Heap code: If there is at least one free block blk won't be NULL at the end of the search loop, so -ENOMEM won't be returned and the else branch of "if (bs == s || be == e)" will be taken, corrupting the management structures.
Signed-off-by: Guillaume Knispel <gknispel@proformatique.com> Acked-by: Timur Tabi <timur@freescale.com> Signed-off-by: Kumar Gala <galak@kernel.crashing.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
--- arch/powerpc/lib/rheap.c | 1 + 1 file changed, 1 insertion(+)
--- a/arch/powerpc/lib/rheap.c +++ b/arch/powerpc/lib/rheap.c @@ -556,6 +556,7 @@ unsigned long rh_alloc_fixed(rh_info_t * be = blk->start + blk->size; if (s >= bs && e <= be) break; + blk = NULL; } if (blk == NULL)
| |