Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 221b1bd3 authored by Al Cooper's avatar Al Cooper Committed by Artem Bityutskiy
Browse files

mtd: mtd_torturetest can cause stack overflows 



mtd_torturetest uses the module parm "ebcnt" to control the size of a
stack based array of int's. When "ebcnt" is large, Ex: 1000, it
causes stack overflows on systems with small kernel stacks. The fix
is to move the array from the stack to kmalloc memory.

Signed-off-by: default avatarAl Cooper <alcooperx@gmail.com>
Signed-off-by: default avatarArtem Bityutskiy <artem.bityutskiy@linux.intel.com>
parent eb82038f

drivers/mtd/tests/mtd_torturetest.c

+11 −14
Original line number Diff line number Diff line
@@ -208,7 +208,7 @@ static inline int write_pattern(int ebnum, void *buf) 
static int __init tort_init(void)

{

	int err = 0, i, infinite = !cycles_count;

	int bad_ebs[ebcnt];

	int *bad_ebs;



	printk(KERN_INFO "\n");

	printk(KERN_INFO "=================================================\n");
@@ -250,28 +250,24 @@ static int __init tort_init(void) 


	err = -ENOMEM;

	patt_5A5 = kmalloc(mtd->erasesize, GFP_KERNEL);

	if (!patt_5A5) {

		pr_err("error: cannot allocate memory\n");

	if (!patt_5A5)

		goto out_mtd;

	}



	patt_A5A = kmalloc(mtd->erasesize, GFP_KERNEL);

	if (!patt_A5A) {

		pr_err("error: cannot allocate memory\n");

	if (!patt_A5A)

		goto out_patt_5A5;

	}



	patt_FF = kmalloc(mtd->erasesize, GFP_KERNEL);

	if (!patt_FF) {

		pr_err("error: cannot allocate memory\n");

	if (!patt_FF)

		goto out_patt_A5A;

	}



	check_buf = kmalloc(mtd->erasesize, GFP_KERNEL);

	if (!check_buf) {

		pr_err("error: cannot allocate memory\n");

	if (!check_buf)

		goto out_patt_FF;

	}



	bad_ebs = kcalloc(ebcnt, sizeof(*bad_ebs), GFP_KERNEL);

	if (!bad_ebs)

		goto out_check_buf;



	err = 0;
@@ -290,7 +286,6 @@ static int __init tort_init(void) 
	/*

	 * Check if there is a bad eraseblock among those we are going to test.

	 */

	memset(&bad_ebs[0], 0, sizeof(int) * ebcnt);

	if (mtd_can_have_bb(mtd)) {

		for (i = eb; i < eb + ebcnt; i++) {

			err = mtd_block_isbad(mtd, (loff_t)i * mtd->erasesize);
@@ -394,6 +389,8 @@ static int __init tort_init(void) 


	pr_info("finished after %u erase cycles\n",

	       erase_cycles);

	kfree(bad_ebs);

out_check_buf:

	kfree(check_buf);

out_patt_FF:

	kfree(patt_FF);