Messages in this thread Patch in this message | | | Date | Thu, 30 Apr 2009 19:41:06 -0500 | From | Jack Steiner <> | Subject | [PATCH] - Fix memory corruption in slbq |
| |
Fix memory corruption caused by slqb overrunning the end of the page allocated in kmem_cache_dyn_array_alloc() for initial caches.
Signed-off-by: Jack Steiner <steiner@sgi.com>
--- mm/slqb.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
Index: linux/mm/slqb.c =================================================================== --- linux.orig/mm/slqb.c 2009-04-30 15:47:16.000000000 -0500 +++ linux/mm/slqb.c 2009-04-30 19:08:33.000000000 -0500 @@ -2194,15 +2194,14 @@ static void *kmem_cache_dyn_array_alloc( * never get freed by definition so we can do it rather * simply. */ - if (!nextmem) { + if (!nextmem || offset_in_page(nextmem) + size > PAGE_SIZE) { nextmem = alloc_pages_exact(size, GFP_KERNEL); if (!nextmem) return NULL; } ret = nextmem; nextmem = (void *)((unsigned long)ret + size); - if ((unsigned long)ret >> PAGE_SHIFT != - (unsigned long)nextmem >> PAGE_SHIFT) + if (offset_in_page(ret) + size >= PAGE_SIZE) nextmem = NULL; memset(ret, 0, size); return ret;
| |