2006-03-12 05:15:21

by Akinobu Mita

Subject: [PATCH] fix swap cluster offset

When we've allocated SWAPFILE_CLUSTER pages, ->cluster_next should
be the first index of swap cluster. But current code probably sets it
wrong offset.

Signed-off-by: Akinobu Mita <[email protected]>

Index: work/mm/swapfile.c
===================================================================
--- work.orig/mm/swapfile.c
+++ work/mm/swapfile.c
@@ -116,7 +116,7 @@ static inline unsigned long scan_swap_ma
last_in_cluster = offset + SWAPFILE_CLUSTER;
else if (offset == last_in_cluster) {
spin_lock(&swap_lock);
- si->cluster_next = offset-SWAPFILE_CLUSTER-1;
+ si->cluster_next = offset-SWAPFILE_CLUSTER+1;
goto cluster;
}
if (unlikely(--latency_ration < 0)) {

2006-03-13 16:53:20

by Hugh Dickins

Subject: Re: [PATCH] fix swap cluster offset

On Sun, 12 Mar 2006, Akinobu Mita wrote:

> When we've allocated SWAPFILE_CLUSTER pages, ->cluster_next should
> be the first index of swap cluster. But current code probably sets it
> wrong offset.
>
> Signed-off-by: Akinobu Mita <[email protected]>

Acked-by: Hugh Dickins <[email protected]>

Very good eye! My shame.
No need to say "probably" above, it was simply wrong.

By a stroke of luck, it's no worse than a slight inefficiency in an
algorithm only used when we're already going slow; but (if offset had
been signed, or not checked against highest_bit for unrelated reasons)
it could very easily have tried to access and modify swap_map[-1].

Anyway, thanks for catching that:
Andrew, please apply (but not desperate for 2.6.16).

Hugh

> Index: work/mm/swapfile.c
> ===================================================================
> --- work.orig/mm/swapfile.c
> +++ work/mm/swapfile.c
> @@ -116,7 +116,7 @@ static inline unsigned long scan_swap_ma
> last_in_cluster = offset + SWAPFILE_CLUSTER;
> else if (offset == last_in_cluster) {
> spin_lock(&swap_lock);
> - si->cluster_next = offset-SWAPFILE_CLUSTER-1;
> + si->cluster_next = offset-SWAPFILE_CLUSTER+1;
> goto cluster;
> }
> if (unlikely(--latency_ration < 0)) {