lkml.org 
[lkml]   [2009]   [Mar]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[patch 014/114] mm: vmap fix overflow
    2.6.28-stable review patch.  If anyone has any objections, please let us know.

    ------------------

    From: Nick Piggin <npiggin@suse.de>

    commit 7766970cc13e9071b356b1f2a48a9eb8675bfcce upstream.

    The new vmap allocator can wrap the address and get confused in the case
    of large allocations or VMALLOC_END near the end of address space.

    Problem reported by Christoph Hellwig on a 32-bit XFS workload.

    Signed-off-by: Nick Piggin <npiggin@suse.de>
    Reported-by: Christoph Hellwig <hch@lst.de>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

    ---
    mm/vmalloc.c | 7 +++++++
    1 file changed, 7 insertions(+)

    --- a/mm/vmalloc.c
    +++ b/mm/vmalloc.c
    @@ -323,6 +323,7 @@ static struct vmap_area *alloc_vmap_area
    unsigned long addr;
    int purged = 0;

    + BUG_ON(!size);
    BUG_ON(size & ~PAGE_MASK);

    va = kmalloc_node(sizeof(struct vmap_area),
    @@ -334,6 +335,9 @@ retry:
    addr = ALIGN(vstart, align);

    spin_lock(&vmap_area_lock);
    + if (addr + size - 1 < addr)
    + goto overflow;
    +
    /* XXX: could have a last_hole cache */
    n = vmap_area_root.rb_node;
    if (n) {
    @@ -365,6 +369,8 @@ retry:

    while (addr + size > first->va_start && addr + size <= vend) {
    addr = ALIGN(first->va_end + PAGE_SIZE, align);
    + if (addr + size - 1 < addr)
    + goto overflow;

    n = rb_next(&first->rb_node);
    if (n)
    @@ -375,6 +381,7 @@ retry:
    }
    found:
    if (addr + size > vend) {
    +overflow:
    spin_unlock(&vmap_area_lock);
    if (!purged) {
    purge_vmap_area_lazy();



    \
     
     \ /
      Last update: 2009-03-14 02:27    [W:4.715 / U:0.024 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site