lkml.org 
[lkml]   [2009]   [Apr]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
Subject[PATCH] - Fix memory corruption in slbq
Fix memory corruption caused by slqb overrunning the end
of the page allocated in kmem_cache_dyn_array_alloc() for
initial caches.


Signed-off-by: Jack Steiner <steiner@sgi.com>

---
mm/slqb.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
Index: linux/mm/slqb.c
===================================================================
--- linux.orig/mm/slqb.c 2009-04-30 15:47:16.000000000 -0500
+++ linux/mm/slqb.c 2009-04-30 19:08:33.000000000 -0500
@@ -2194,15 +2194,14 @@ static void *kmem_cache_dyn_array_alloc(
* never get freed by definition so we can do it rather
* simply.
*/
- if (!nextmem) {
+ if (!nextmem || offset_in_page(nextmem) + size > PAGE_SIZE) {
nextmem = alloc_pages_exact(size, GFP_KERNEL);
if (!nextmem)
return NULL;
}
ret = nextmem;
nextmem = (void *)((unsigned long)ret + size);
- if ((unsigned long)ret >> PAGE_SHIFT !=
- (unsigned long)nextmem >> PAGE_SHIFT)
+ if (offset_in_page(ret) + size >= PAGE_SIZE)
nextmem = NULL;
memset(ret, 0, size);
return ret;

\
 
 \ /
  Last update: 2009-05-01 02:43    [from the cache]
©2003-2011 Jasper Spaans