lkml.org 
[lkml]   [1999]   [Apr]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Date
SubjectPatch: Re: boundary condition bug fix for vmalloc()
Hi,

On Wed, 21 Apr 1999 17:12:37 -0700 (PDT), kanoj@google.engr.sgi.com
(Kanoj Sarcar) said:

> Under heavy load conditions, get_vm_area() might end up allocating an
> address range beyond VMALLOC_END. The problem is after the for loop in
> get_vm_area() terminates, no consistency check (addr > VMALLOC_END -
> size) is performed on the "addr".

Agreed, and the patch looks OK. Moving the test outside the for loop
entirely has the same effect while shaving a few cycles off the
function. The existing clearly broken in not checking the size of the
final area if we ran off the end of the vm_area chain.

--Stephen

----------------------------------------------------------------
--- mm/vmalloc.c~ Mon Jan 18 18:19:28 1999
+++ mm/vmalloc.c Thu Apr 22 16:12:58 1999
@@ -161,11 +161,11 @@
for (p = &vmlist; (tmp = *p) ; p = &tmp->next) {
if (size + addr < (unsigned long) tmp->addr)
break;
- if (addr > VMALLOC_END-size) {
- kfree(area);
- return NULL;
- }
addr = tmp->size + (unsigned long) tmp->addr;
+ }
+ if (addr > VMALLOC_END-size) {
+ kfree(area);
+ return NULL;
}
area->addr = (void *)addr;
area->size = size + PAGE_SIZE;
----------------------------------------------------------------
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:51    [W:0.033 / U:0.060 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site