From mboxrd@z Thu Jan 1 00:00:00 1970 Received: by wa-out-1112.google.com with SMTP id j37so2667805waf.22 for ; Tue, 07 Oct 2008 09:57:31 -0700 (PDT) Message-ID: <84144f020810070957y241a16d6y2d03f451aa3dd4a7@mail.gmail.com> Date: Tue, 7 Oct 2008 19:57:31 +0300 From: "Pekka Enberg" Subject: Re: [BUG] SLOB's krealloc() seems bust In-Reply-To: <1223397455.13453.385.camel@calx> MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Content-Disposition: inline References: <1223387841.26330.36.camel@lappy.programming.kicks-ass.net> <48EB6D2C.30806@linux-foundation.org> <1223391655.13453.344.camel@calx> <1223395846.26330.55.camel@lappy.programming.kicks-ass.net> <1223397455.13453.385.camel@calx> Sender: owner-linux-mm@kvack.org Return-Path: To: Matt Mackall Cc: Peter Zijlstra , Christoph Lameter , linux-mm , Nick Piggin , Linus Torvalds , Ingo Molnar , linux-kernel , akpm List-ID: Hi Matt, On Tue, Oct 7, 2008 at 7:37 PM, Matt Mackall wrote: > SLOB: fix bogus ksize calculation > > SLOB's ksize calculation was braindamaged and generally harmlessly > underreported the allocation size. But for very small buffers, it could > in fact overreport them, leading code depending on krealloc to overrun > the allocation and trample other data. > > Signed-off-by: Matt Mackall > Tested-by: Peter Zijlstra > > diff -r 5e32b09a1b2b mm/slob.c > --- a/mm/slob.c Fri Oct 03 14:04:43 2008 -0500 > +++ b/mm/slob.c Tue Oct 07 11:27:47 2008 -0500 > @@ -515,7 +515,7 @@ > > sp = (struct slob_page *)virt_to_page(block); > if (slob_page(sp)) > - return ((slob_t *)block - 1)->units + SLOB_UNIT; > + return (((slob_t *)block - 1)->units - 1) * SLOB_UNIT; Hmm. I don't understand why we do the "minus one" thing here. Aren't we underestimating the size now? Side note, why aren't we using slob_units() here? > else > return sp->page.private; > } > > > > > > -- > Mathematics is the supreme nostalgia of our time. > > -- > To unsubscribe from this list: send the line "unsubscribe linux-kernel" in > the body of a message to majordomo@vger.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html > Please read the FAQ at http://www.tux.org/lkml/ > -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: email@kvack.org