Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8ed030dd authored by Gerrit Renker's avatar Gerrit Renker Committed by David S. Miller
Browse files

dccp: fix bug in cache allocation 



This fixes a bug introduced in commit de4ef86c
("dccp: fix dccp rmmod when kernel configured to use slub", 17 Jan): the
vsnprintf used sizeof(slab_name_fmt), which became truncated to 4 bytes, since
slab_name_fmt is now a 4-byte pointer and no longer a 32-character array.

This lead to error messages such as
 FATAL: Error inserting dccp: No buffer space available

 >> kernel: [ 1456.341501] kmem_cache_create: duplicate cache cci
generated due to the truncation after the 3rd character.

Fixed for the moment by introducing a symbolic constant. Tested to fix the bug.

Signed-off-by: default avatarGerrit Renker <gerrit@erg.abdn.ac.uk>
Acked-by: default avatarNeil Horman <nhorman@tuxdriver.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent f6815077

net/dccp/ccid.c

+1 −1
Original line number Diff line number Diff line
@@ -83,7 +83,7 @@ static struct kmem_cache *ccid_kmem_cache_create(int obj_size, char *slab_name_f 
	va_list args;



	va_start(args, fmt);

	vsnprintf(slab_name_fmt, sizeof(slab_name_fmt), fmt, args);

	vsnprintf(slab_name_fmt, CCID_SLAB_NAME_LENGTH, fmt, args);

	va_end(args);



	slab = kmem_cache_create(slab_name_fmt, sizeof(struct ccid) + obj_size, 0,

net/dccp/ccid.h

+5 −3
Original line number Diff line number Diff line
@@ -19,7 +19,9 @@ 
#include <linux/list.h>

#include <linux/module.h>



/* maximum value for a CCID (RFC 4340, 19.5) */

#define CCID_MAX		255

#define CCID_SLAB_NAME_LENGTH	32



struct tcp_info;
@@ -49,8 +51,8 @@ struct ccid_operations { 
	const char		*ccid_name;

	struct kmem_cache	*ccid_hc_rx_slab,

				*ccid_hc_tx_slab;

	char			ccid_hc_rx_slab_name[32];

	char			ccid_hc_tx_slab_name[32];

	char			ccid_hc_rx_slab_name[CCID_SLAB_NAME_LENGTH];

	char			ccid_hc_tx_slab_name[CCID_SLAB_NAME_LENGTH];

	__u32			ccid_hc_rx_obj_size,

				ccid_hc_tx_obj_size;

	/* Interface Routines */