Messages in this thread Patch in this message | | | From | (Kanoj Sarcar) | Subject | boundary condition bug fix for vmalloc() | Date | Wed, 21 Apr 1999 17:12:37 -0700 (PDT) |
| |
Hi,
Under heavy load conditions, get_vm_area() might end up allocating an address range beyond VMALLOC_END. The problem is after the for loop in get_vm_area() terminates, no consistency check (addr > VMALLOC_END - size) is performed on the "addr".
I believe the following patch will fix the problem:
--- vmalloc.old Wed Apr 21 16:52:05 1999 +++ mm/vmalloc.c Wed Apr 21 16:53:08 1999 @@ -161,11 +161,11 @@ for (p = &vmlist; (tmp = *p) ; p = &tmp->next) { if (size + addr < (unsigned long) tmp->addr) break; + addr = tmp->size + (unsigned long) tmp->addr; if (addr > VMALLOC_END-size) { kfree(area); return NULL; } - addr = tmp->size + (unsigned long) tmp->addr; } area->addr = (void *)addr; area->size = size + PAGE_SIZE; Please let me know if this patch is pulled into the source tree, so I can update my tree.
Thanks.
Kanoj kanoj@engr.sgi.com
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |