Commit 46596338 authored by Chris Humbert's avatar Chris Humbert Committed by Linus Torvalds

[PATCH] fix broken lib/genalloc.c

genalloc improperly stores the sizes of freed chunks, allocates overlapping
memory regions, and oopses after its in-band data is overwritten.
Signed-off-by: default avatarChris Humbert <mahadri-kernel@drigon.com>
Cc: Jes Sorensen <jes@trained-monkey.org>
Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
parent 7729ac5e
...@@ -95,12 +95,10 @@ unsigned long gen_pool_alloc(struct gen_pool *poolp, int size) ...@@ -95,12 +95,10 @@ unsigned long gen_pool_alloc(struct gen_pool *poolp, int size)
if (size > max_chunk_size) if (size > max_chunk_size)
return 0; return 0;
i = 0;
size = max(size, 1 << ALLOC_MIN_SHIFT); size = max(size, 1 << ALLOC_MIN_SHIFT);
s = roundup_pow_of_two(size); i = fls(size - 1);
s = 1 << i;
j = i; j = i -= ALLOC_MIN_SHIFT;
spin_lock_irqsave(&poolp->lock, flags); spin_lock_irqsave(&poolp->lock, flags);
while (!h[j].next) { while (!h[j].next) {
...@@ -153,10 +151,10 @@ void gen_pool_free(struct gen_pool *poolp, unsigned long ptr, int size) ...@@ -153,10 +151,10 @@ void gen_pool_free(struct gen_pool *poolp, unsigned long ptr, int size)
if (size > max_chunk_size) if (size > max_chunk_size)
return; return;
i = 0;
size = max(size, 1 << ALLOC_MIN_SHIFT); size = max(size, 1 << ALLOC_MIN_SHIFT);
s = roundup_pow_of_two(size); i = fls(size - 1);
s = 1 << i;
i -= ALLOC_MIN_SHIFT;
a = ptr; a = ptr;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment