Skip to content

Commit

Permalink
[PATCH] fix potential stack overflow in mm/slab.c
Browse files Browse the repository at this point in the history
On High end systems (1024 or so cpus) this can potentially cause stack
overflow. Fix the stack usage.

Signed-off-by: Suresh Siddha <suresh.b.siddha@intel.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
  • Loading branch information
Siddha, Suresh B authored and Linus Torvalds committed Sep 26, 2006
1 parent 980128f commit d2e7b7d
Showing 1 changed file with 14 additions and 9 deletions.
23 changes: 14 additions & 9 deletions mm/slab.c
Original file line number Diff line number Diff line change
Expand Up @@ -3725,38 +3725,42 @@ static void do_ccupdate_local(void *info)
static int do_tune_cpucache(struct kmem_cache *cachep, int limit,
int batchcount, int shared)
{
struct ccupdate_struct new;
struct ccupdate_struct *new;
int i;

memset(&new.new, 0, sizeof(new.new));
new = kzalloc(sizeof(*new), GFP_KERNEL);
if (!new)
return -ENOMEM;

for_each_online_cpu(i) {
new.new[i] = alloc_arraycache(cpu_to_node(i), limit,
new->new[i] = alloc_arraycache(cpu_to_node(i), limit,
batchcount);
if (!new.new[i]) {
if (!new->new[i]) {
for (i--; i >= 0; i--)
kfree(new.new[i]);
kfree(new->new[i]);
kfree(new);
return -ENOMEM;
}
}
new.cachep = cachep;
new->cachep = cachep;

on_each_cpu(do_ccupdate_local, (void *)&new, 1, 1);
on_each_cpu(do_ccupdate_local, (void *)new, 1, 1);

check_irq_on();
cachep->batchcount = batchcount;
cachep->limit = limit;
cachep->shared = shared;

for_each_online_cpu(i) {
struct array_cache *ccold = new.new[i];
struct array_cache *ccold = new->new[i];
if (!ccold)
continue;
spin_lock_irq(&cachep->nodelists[cpu_to_node(i)]->list_lock);
free_block(cachep, ccold->entry, ccold->avail, cpu_to_node(i));
spin_unlock_irq(&cachep->nodelists[cpu_to_node(i)]->list_lock);
kfree(ccold);
}

kfree(new);
return alloc_kmemlist(cachep);
}

Expand Down Expand Up @@ -4274,6 +4278,7 @@ static int leaks_show(struct seq_file *m, void *p)
show_symbol(m, n[2*i+2]);
seq_putc(m, '\n');
}

return 0;
}

Expand Down

0 comments on commit d2e7b7d

Please sign in to comment.