Messages in this thread Patch in this message | | | Date | Thu, 04 Feb 2010 12:56:38 +0900 | From | Tejun Heo <> | Subject | Re: patch idr-fix-a-critical-misallocation-bug.patch added to 2.6.32-stable tree |
| |
On 02/04/2010 12:46 PM, Stefan Lippers-Hollmann wrote: > Hi > > [ Sorry for not reporting this earlier today, while > idr-fix-a-critical-misallocation-bug was still part of queue-2.6.32, but > bisecting this (and previously net-restore-ip-source-validation.patch) > took its time. ] > > On Thursday 04 February 2010, Greg KH wrote: >> On Wed, Feb 03, 2010 at 08:21:39AM -0500, Eric Paris wrote: >>> On Wed, 2010-02-03 at 14:21 +0900, Tejun Heo wrote: >>> >>>>> Eric Paris located a bug in idr. With IDR_BITS of 6, it grows to three >>>>> layers when id 4096 is first allocated. When that happens, idr wraps >>>>> incorrectly and searches the idr array ignoring the high bits. The >>>>> following test code from Eric demonstrates the bug nicely. >>>> ... >>>>> Based-on-patch-from: Eric Paris <eparis@redhat.com> >>>>> Reported-by: Eric Paris <eparis@redhat.com> >>>>> Signed-off-by: Tejun Heo <tj@kernel.org> >>>>> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> >>>>> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> >>>>> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> >>>> >>>> Greg, can this wait a bit more, maybe until the next -stable release? >>>> The code there is very fragile and this has been broken forever so I >>>> think it would be better if we wait a bit more while it gets testing >>>> mainline. > > Just as a side note, this patch as part of the 2.6.32 stable queue (before > this patch was removed again) seems to break logging into KDE 4.3.4 through > kdm on several different systems with Intel chipsets/ graphics (kvm > active). X and kdm start normally, logging in shows the ksplash, which > quickly terminates the xsession and dumps back to kdm. Removing just this > patch from 2.6.32 + (previous) stable queue fixes the problem for me; > however 2.6.33-rc6-git3 seems to be affected as well, but freezes X, > instead of "just" terminating the current X session and reverting to kdm. > > While I have reports from several different intel chipsets, I can > personally reproduce it on an Intel D945GCLF2 mainboard:
Does this patch make any difference?
diff --git a/lib/idr.c b/lib/idr.c index ba7d37c..a96c604 100644 --- a/lib/idr.c +++ b/lib/idr.c @@ -140,7 +140,8 @@ static int sub_alloc(struct idr *idp, int *starting_id, struct idr_layer **pa) id = *starting_id; restart: p = idp->top; - l = p->layer; + l = idp->layers; + pa[l--] = NULL; while (1) { /* * We run around this while until we reach the leaf node...
-- tejun
| |