[PATCH] - Fix memory corruption in slbq

[PATCH] - Fix memory corruption in slbq

[Jack Steiner]

Fix memory corruption caused by slqb overrunning the end
of the page allocated in kmem_cache_dyn_array_alloc() for
initial caches.


Signed-off-by: Jack Steiner <steiner@sgi.com>

---
 mm/slqb.c |    5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

Index: linux/mm/slqb.c
===================================================================
--- linux.orig/mm/slqb.c	2009-04-30 15:47:16.000000000 -0500
+++ linux/mm/slqb.c	2009-04-30 19:08:33.000000000 -0500
@@ -2194,15 +2194,14 @@ static void *kmem_cache_dyn_array_alloc(
 		 * never get freed by definition so we can do it rather
 		 * simply.
 		 */
-		if (!nextmem) {
+		if (!nextmem || offset_in_page(nextmem) + size > PAGE_SIZE) {
 			nextmem = alloc_pages_exact(size, GFP_KERNEL);
 			if (!nextmem)
 				return NULL;
 		}
 		ret = nextmem;
 		nextmem = (void *)((unsigned long)ret + size);
-		if ((unsigned long)ret >> PAGE_SHIFT !=
-				(unsigned long)nextmem >> PAGE_SHIFT)
+		if (offset_in_page(ret) + size >= PAGE_SIZE)
 			nextmem = NULL;
 		memset(ret, 0, size);
 		return ret;

Re: [PATCH] - Fix memory corruption in slbq

[Pekka Enberg]

Hi Jack,

(Please cc me when sending patches to SL*B.)

On Fri, May 1, 2009 at 3:41 AM, Jack Steiner <steiner@sgi.com> wrote:
> Fix memory corruption caused by slqb overrunning the end
> of the page allocated in kmem_cache_dyn_array_alloc() for
> initial caches.
>
> Signed-off-by: Jack Steiner <steiner@sgi.com>
>
> ---
>  mm/slqb.c |    5 ++---
>  1 file changed, 2 insertions(+), 3 deletions(-)
>
> Index: linux/mm/slqb.c
> ===================================================================
> --- linux.orig/mm/slqb.c        2009-04-30 15:47:16.000000000 -0500
> +++ linux/mm/slqb.c     2009-04-30 19:08:33.000000000 -0500
> @@ -2194,15 +2194,14 @@ static void *kmem_cache_dyn_array_alloc(
>                 * never get freed by definition so we can do it rather
>                 * simply.
>                 */
> -               if (!nextmem) {
> +               if (!nextmem || offset_in_page(nextmem) + size > PAGE_SIZE) {
>                        nextmem = alloc_pages_exact(size, GFP_KERNEL);
>                        if (!nextmem)
>                                return NULL;
>                }
>                ret = nextmem;
>                nextmem = (void *)((unsigned long)ret + size);
> -               if ((unsigned long)ret >> PAGE_SHIFT !=
> -                               (unsigned long)nextmem >> PAGE_SHIFT)
> +               if (offset_in_page(ret) + size >= PAGE_SIZE)
>                        nextmem = NULL;
>                memset(ret, 0, size);
>                return ret;

I don't think this is needed now that commit 8804e6f ("SLQB:  fix dumb
early allocation cache") is merged:

http://git.kernel.org/?p=linux/kernel/git/penberg/slab-2.6.git;a=commitdiff_plain;h=8804e6f0001668656d4cb2a329e1a6e69e695a0f

Or do you still see the corruption with it?

                                              Pekka

Re: [PATCH] - Fix memory corruption in slbq

[Jack Steiner]

> 
> I don't think this is needed now that commit 8804e6f ("SLQB:  fix dumb
> early allocation cache") is merged:
> 
> http://git.kernel.org/?p=linux/kernel/git/penberg/slab-2.6.git;a=commitdiff_plain;h=8804e6f0001668656d4cb2a329e1a6e69e695a0f
> 
> Or do you still see the corruption with it?

No. The above patch is an equivalent ( & better) fix. for the problem.
You can ignore the patch that I sent.

--- jack

Re: [PATCH] - Fix memory corruption in slbq

[Pekka Enberg]

Hi Jack,

On Sun, 2009-05-03 at 07:24 -0500, Jack Steiner wrote:
> > I don't think this is needed now that commit 8804e6f ("SLQB:  fix dumb
> > early allocation cache") is merged:
> > 
> > http://git.kernel.org/?p=linux/kernel/git/penberg/slab-2.6.git;a=commitdiff_plain;h=8804e6f0001668656d4cb2a329e1a6e69e695a0f
> > 
> > Or do you still see the corruption with it?
> 
> No. The above patch is an equivalent ( & better) fix. for the problem.
> You can ignore the patch that I sent.

OK, thanks for the patch anyway!

			Pekka