Gitweb:
http://git.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=d32ddd8f20e7d7a49c45c337c2079be03c77dc41
Commit: d32ddd8f20e7d7a49c45c337c2079be03c77dc41
Parent: a3474224e6a01924be40a8255636ea5522c1023a
Author: Nick Piggin <[EMAIL PROTECTED]>
AuthorDate: Thu Nov 15 12:32:04 2007 +0100
Committer: Linus Torvalds <[EMAIL PROTECTED]>
CommitDate: Thu Nov 15 08:36:27 2007 -0800
slob: fix memory corruption
Previously, it would be possible for prev->next to point to
&free_slob_pages, and thus we would try to move a list onto itself, and
bad things would happen.
It seems a bit hairy to be doing list operations with the list marker as
an entry, rather than a head, but...
this resolves the following crash:
http://bugzilla.kernel.org/show_bug.cgi?id=9379
Signed-off-by: Nick Piggin <[EMAIL PROTECTED]>
Signed-off-by: Ingo Molnar <[EMAIL PROTECTED]>
Acked-by: Matt Mackall <[EMAIL PROTECTED]>
Signed-off-by: Linus Torvalds <[EMAIL PROTECTED]>
---
mm/slob.c | 3 ++-
1 files changed, 2 insertions(+), 1 deletions(-)
diff --git a/mm/slob.c b/mm/slob.c
index 5bc2ceb..08a9bd9 100644
--- a/mm/slob.c
+++ b/mm/slob.c
@@ -321,7 +321,8 @@ static void *slob_alloc(size_t size, gfp_t gfp, int align,
int node)
/* Improve fragment distribution and reduce our average
* search time by starting our next search here. (see
* Knuth vol 1, sec 2.5, pg 449) */
- if (free_slob_pages.next != prev->next)
+ if (prev != free_slob_pages.prev &&
+ free_slob_pages.next != prev->next)
list_move_tail(&free_slob_pages, prev->next);
break;
}
-
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at http://vger.kernel.org/majordomo-info.html
