[prev in list] [next in list] [prev in thread] [next in thread] 

List:       linux-mm
Subject:    Patch: Re: boundary condition bug fix for vmalloc()
From:       "Stephen C. Tweedie" <sct () redhat ! com>
Date:       1999-04-22 15:30:01
[Download RAW message or body]

Hi,

On Wed, 21 Apr 1999 17:12:37 -0700 (PDT), kanoj@google.engr.sgi.com
(Kanoj Sarcar) said:

> Under heavy load conditions, get_vm_area() might end up allocating an
> address range beyond VMALLOC_END. The problem is after the for loop in
> get_vm_area() terminates, no consistency check (addr > VMALLOC_END -
> size) is performed on the "addr".

Agreed, and the patch looks OK.  Moving the test outside the for loop
entirely has the same effect while shaving a few cycles off the
function.  The existing clearly broken in not checking the size of the
final area if we ran off the end of the vm_area chain.

--Stephen

----------------------------------------------------------------
--- mm/vmalloc.c~	Mon Jan 18 18:19:28 1999
+++ mm/vmalloc.c	Thu Apr 22 16:12:58 1999
@@ -161,11 +161,11 @@
 	for (p = &vmlist; (tmp = *p) ; p = &tmp->next) {
 		if (size + addr < (unsigned long) tmp->addr)
 			break;
-		if (addr > VMALLOC_END-size) {
-			kfree(area);
-			return NULL;
-		}
 		addr = tmp->size + (unsigned long) tmp->addr;
+	}
+	if (addr > VMALLOC_END-size) {
+		kfree(area);
+		return NULL;
 	}
 	area->addr = (void *)addr;
 	area->size = size + PAGE_SIZE;
----------------------------------------------------------------
--
To unsubscribe, send a message with 'unsubscribe linux-mm my@address'
in the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://humbolt.geo.uu.nl/Linux-MM/

[prev in list] [next in list] [prev in thread] [next in thread]