lkml.org 
[lkml]   [2010]   [Feb]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
SubjectRe: patch idr-fix-a-critical-misallocation-bug.patch added to 2.6.32-stable tree
On 02/04/2010 12:46 PM, Stefan Lippers-Hollmann wrote:
> Hi
>
> [ Sorry for not reporting this earlier today, while
> idr-fix-a-critical-misallocation-bug was still part of queue-2.6.32, but
> bisecting this (and previously net-restore-ip-source-validation.patch)
> took its time. ]
>
> On Thursday 04 February 2010, Greg KH wrote:
>> On Wed, Feb 03, 2010 at 08:21:39AM -0500, Eric Paris wrote:
>>> On Wed, 2010-02-03 at 14:21 +0900, Tejun Heo wrote:
>>>
>>>>> Eric Paris located a bug in idr. With IDR_BITS of 6, it grows to three
>>>>> layers when id 4096 is first allocated. When that happens, idr wraps
>>>>> incorrectly and searches the idr array ignoring the high bits. The
>>>>> following test code from Eric demonstrates the bug nicely.
>>>> ...
>>>>> Based-on-patch-from: Eric Paris <eparis@redhat.com>
>>>>> Reported-by: Eric Paris <eparis@redhat.com>
>>>>> Signed-off-by: Tejun Heo <tj@kernel.org>
>>>>> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
>>>>> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
>>>>> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
>>>>
>>>> Greg, can this wait a bit more, maybe until the next -stable release?
>>>> The code there is very fragile and this has been broken forever so I
>>>> think it would be better if we wait a bit more while it gets testing
>>>> mainline.
>
> Just as a side note, this patch as part of the 2.6.32 stable queue (before
> this patch was removed again) seems to break logging into KDE 4.3.4 through
> kdm on several different systems with Intel chipsets/ graphics (kvm
> active). X and kdm start normally, logging in shows the ksplash, which
> quickly terminates the xsession and dumps back to kdm. Removing just this
> patch from 2.6.32 + (previous) stable queue fixes the problem for me;
> however 2.6.33-rc6-git3 seems to be affected as well, but freezes X,
> instead of "just" terminating the current X session and reverting to kdm.
>
> While I have reports from several different intel chipsets, I can
> personally reproduce it on an Intel D945GCLF2 mainboard:

Does this patch make any difference?

diff --git a/lib/idr.c b/lib/idr.c
index ba7d37c..a96c604 100644
--- a/lib/idr.c
+++ b/lib/idr.c
@@ -140,7 +140,8 @@ static int sub_alloc(struct idr *idp, int *starting_id, struct idr_layer **pa)
id = *starting_id;
restart:
p = idp->top;
- l = p->layer;
+ l = idp->layers;
+ pa[l--] = NULL;
while (1) {
/*
* We run around this while until we reach the leaf node...

--
tejun


\
 
 \ /
  Last update: 2010-02-04 04:53    [W:0.102 / U:0.076 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site