lkml.org 
[lkml]   [2009]   [Apr]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[PATCH] - Fix memory corruption in slbq
    Fix memory corruption caused by slqb overrunning the end
    of the page allocated in kmem_cache_dyn_array_alloc() for
    initial caches.


    Signed-off-by: Jack Steiner <steiner@sgi.com>

    ---
    mm/slqb.c | 5 ++---
    1 file changed, 2 insertions(+), 3 deletions(-)

    Index: linux/mm/slqb.c
    ===================================================================
    --- linux.orig/mm/slqb.c 2009-04-30 15:47:16.000000000 -0500
    +++ linux/mm/slqb.c 2009-04-30 19:08:33.000000000 -0500
    @@ -2194,15 +2194,14 @@ static void *kmem_cache_dyn_array_alloc(
    * never get freed by definition so we can do it rather
    * simply.
    */
    - if (!nextmem) {
    + if (!nextmem || offset_in_page(nextmem) + size > PAGE_SIZE) {
    nextmem = alloc_pages_exact(size, GFP_KERNEL);
    if (!nextmem)
    return NULL;
    }
    ret = nextmem;
    nextmem = (void *)((unsigned long)ret + size);
    - if ((unsigned long)ret >> PAGE_SHIFT !=
    - (unsigned long)nextmem >> PAGE_SHIFT)
    + if (offset_in_page(ret) + size >= PAGE_SIZE)
    nextmem = NULL;
    memset(ret, 0, size);
    return ret;

    \
     
     \ /
      Last update: 2009-05-01 02:43    [W:0.052 / U:0.416 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site