Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 714b8171 authored by Pekka Enberg's avatar Pekka Enberg Committed by Linus Torvalds
Browse files

slab: ensure cache_alloc_refill terminates 

If slab->inuse is corrupted, cache_alloc_refill can enter an infinite
loop as detailed by Michael Richardson in the following post:
<http://lkml.org/lkml/2007/2/16/292

>. This adds a BUG_ON to catch
those cases.

Cc: Michael Richardson <mcr@sandelman.ca>
Acked-by: default avatarChristoph Lameter <clameter@sgi.com>
Signed-off-by: default avatarPekka Enberg <penberg@cs.helsinki.fi>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 5f22df00

mm/slab.c

+8 −0
Original line number Diff line number Diff line
@@ -2990,6 +2990,14 @@ static void *cache_alloc_refill(struct kmem_cache *cachep, gfp_t flags) 
		slabp = list_entry(entry, struct slab, list);

		check_slabp(cachep, slabp);

		check_spinlock_acquired(cachep);



		/*

		 * The slab was either on partial or free list so

		 * there must be at least one object available for

		 * allocation.

		 */

		BUG_ON(slabp->inuse < 0 || slabp->inuse >= cachep->num);



		while (slabp->inuse < cachep->num && batchcount--) {

			STATS_INC_ALLOCED(cachep);

			STATS_INC_ACTIVE(cachep);