• Thadeu Lima de Souza Cascardo's avatar
    genalloc: stop crashing the system when destroying a pool · e3d92b5e
    Thadeu Lima de Souza Cascardo authored
    commit eedce141 upstream.
    
    The genalloc code uses the bitmap API from include/linux/bitmap.h and
    lib/bitmap.c, which is based on long values.  Both bitmap_set from
    lib/bitmap.c and bitmap_set_ll, which is the lockless version from
    genalloc.c, use BITMAP_LAST_WORD_MASK to set the first bits in a long in
    the bitmap.
    
    That one uses (1 << bits) - 1, 0b111, if you are setting the first three
    bits.  This means that the API counts from the least significant bits
    (LSB from now on) to the MSB.  The LSB in the first long is bit 0, then.
    The same works for the lookup functions.
    
    The genalloc code uses longs for the bitmap, as it should.  In
    include/linux/genalloc.h, struct gen_pool_chunk has unsigned long
    bits[0] as its last member.  When allocating the struct, genalloc should
    reserve enough space for the bitmap.  This should be a proper number of
    longs that can fit the amount of bits in the bitmap.
    
    However, genalloc allocates...
    e3d92b5e
genalloc.c 11.1 KB