boundary condition bug fix for vmalloc()

boundary condition bug fix for vmalloc()

[Kanoj Sarcar]

Hi,

Under heavy load conditions, get_vm_area() might end up allocating an
address range beyond VMALLOC_END. The problem is after the for loop
in get_vm_area() terminates, no consistency check (addr > VMALLOC_END
- size) is performed on the "addr". 

I believe the following patch will fix the problem:

--- vmalloc.old		Wed Apr 21 16:52:05 1999
+++ mm/vmalloc.c	Wed Apr 21 16:53:08 1999
@@ -161,11 +161,11 @@
        for (p = &vmlist; (tmp = *p) ; p = &tmp->next) {
                if (size + addr < (unsigned long) tmp->addr)
                        break;
+               addr = tmp->size + (unsigned long) tmp->addr;
                if (addr > VMALLOC_END-size) {
                        kfree(area);
                        return NULL;
                }
-               addr = tmp->size + (unsigned long) tmp->addr;
        }
        area->addr = (void *)addr;
        area->size = size + PAGE_SIZE;
 
Please let me know if this patch is pulled into the source tree, 
so I can update my tree.

Thanks.

Kanoj
kanoj@engr.sgi.com
--
To unsubscribe, send a message with 'unsubscribe linux-mm my@address'
in the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://humbolt.geo.uu.nl/Linux-MM/

Patch: Re: boundary condition bug fix for vmalloc()

[Stephen C. Tweedie]

Hi,

On Wed, 21 Apr 1999 17:12:37 -0700 (PDT), kanoj@google.engr.sgi.com
(Kanoj Sarcar) said:

> Under heavy load conditions, get_vm_area() might end up allocating an
> address range beyond VMALLOC_END. The problem is after the for loop in
> get_vm_area() terminates, no consistency check (addr > VMALLOC_END -
> size) is performed on the "addr".

Agreed, and the patch looks OK.  Moving the test outside the for loop
entirely has the same effect while shaving a few cycles off the
function.  The existing clearly broken in not checking the size of the
final area if we ran off the end of the vm_area chain.

--Stephen

----------------------------------------------------------------
--- mm/vmalloc.c~	Mon Jan 18 18:19:28 1999
+++ mm/vmalloc.c	Thu Apr 22 16:12:58 1999
@@ -161,11 +161,11 @@
 	for (p = &vmlist; (tmp = *p) ; p = &tmp->next) {
 		if (size + addr < (unsigned long) tmp->addr)
 			break;
-		if (addr > VMALLOC_END-size) {
-			kfree(area);
-			return NULL;
-		}
 		addr = tmp->size + (unsigned long) tmp->addr;
+	}
+	if (addr > VMALLOC_END-size) {
+		kfree(area);
+		return NULL;
 	}
 	area->addr = (void *)addr;
 	area->size = size + PAGE_SIZE;
----------------------------------------------------------------
--
To unsubscribe, send a message with 'unsubscribe linux-mm my@address'
in the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://humbolt.geo.uu.nl/Linux-MM/