Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1760302AbZCNBZO (ORCPT ); Fri, 13 Mar 2009 21:25:14 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1752373AbZCNBT5 (ORCPT ); Fri, 13 Mar 2009 21:19:57 -0400 Received: from kroah.org ([198.145.64.141]:34858 "EHLO coco.kroah.org" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1752546AbZCNBTz (ORCPT ); Fri, 13 Mar 2009 21:19:55 -0400 X-Mailbox-Line: From gregkh@mini.kroah.org Fri Mar 13 18:10:33 2009 Message-Id: <20090314011033.444403324@mini.kroah.org> User-Agent: quilt/0.48-1 Date: Fri, 13 Mar 2009 18:09:51 -0700 From: Greg KH To: linux-kernel@vger.kernel.org, stable@kernel.org Cc: Justin Forbes , Zwane Mwaikambo , "Theodore Ts'o" , Randy Dunlap , Dave Jones , Chuck Wolber , Chris Wedgwood , Michael Krufky , Chuck Ebbert , Domenico Andreoli , Willy Tarreau , Rodrigo Rubira Branco , Jake Edge , Eugene Teo , torvalds@linux-foundation.org, akpm@linux-foundation.org, alan@lxorguk.ukuu.org.uk, Nick Piggin Subject: [patch 014/114] mm: vmap fix overflow References: <20090314010937.416083662@mini.kroah.org> Content-Disposition: inline; filename=mm-vmap-fix-overflow.patch In-Reply-To: <20090314011649.GA26170@kroah.com> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1837 Lines: 57 2.6.28-stable review patch. If anyone has any objections, please let us know. ------------------ From: Nick Piggin commit 7766970cc13e9071b356b1f2a48a9eb8675bfcce upstream. The new vmap allocator can wrap the address and get confused in the case of large allocations or VMALLOC_END near the end of address space. Problem reported by Christoph Hellwig on a 32-bit XFS workload. Signed-off-by: Nick Piggin Reported-by: Christoph Hellwig Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman --- mm/vmalloc.c | 7 +++++++ 1 file changed, 7 insertions(+) --- a/mm/vmalloc.c +++ b/mm/vmalloc.c @@ -323,6 +323,7 @@ static struct vmap_area *alloc_vmap_area unsigned long addr; int purged = 0; + BUG_ON(!size); BUG_ON(size & ~PAGE_MASK); va = kmalloc_node(sizeof(struct vmap_area), @@ -334,6 +335,9 @@ retry: addr = ALIGN(vstart, align); spin_lock(&vmap_area_lock); + if (addr + size - 1 < addr) + goto overflow; + /* XXX: could have a last_hole cache */ n = vmap_area_root.rb_node; if (n) { @@ -365,6 +369,8 @@ retry: while (addr + size > first->va_start && addr + size <= vend) { addr = ALIGN(first->va_end + PAGE_SIZE, align); + if (addr + size - 1 < addr) + goto overflow; n = rb_next(&first->rb_node); if (n) @@ -375,6 +381,7 @@ retry: } found: if (addr + size > vend) { +overflow: spin_unlock(&vmap_area_lock); if (!purged) { purge_vmap_area_lazy(); -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/