Commit:     d32ddd8f20e7d7a49c45c337c2079be03c77dc41
Parent:     a3474224e6a01924be40a8255636ea5522c1023a
Author:     Nick Piggin <[EMAIL PROTECTED]>
AuthorDate: Thu Nov 15 12:32:04 2007 +0100
Committer:  Linus Torvalds <[EMAIL PROTECTED]>
CommitDate: Thu Nov 15 08:36:27 2007 -0800

    slob: fix memory corruption
    Previously, it would be possible for prev->next to point to
    &free_slob_pages, and thus we would try to move a list onto itself, and
    bad things would happen.
    It seems a bit hairy to be doing list operations with the list marker as
    an entry, rather than a head, but...
    this resolves the following crash:
    Signed-off-by: Nick Piggin <[EMAIL PROTECTED]>
    Signed-off-by: Ingo Molnar <[EMAIL PROTECTED]>
    Acked-by: Matt Mackall <[EMAIL PROTECTED]>
    Signed-off-by: Linus Torvalds <[EMAIL PROTECTED]>
 mm/slob.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)

diff --git a/mm/slob.c b/mm/slob.c
index 5bc2ceb..08a9bd9 100644
--- a/mm/slob.c
+++ b/mm/slob.c
@@ -321,7 +321,8 @@ static void *slob_alloc(size_t size, gfp_t gfp, int align, 
int node)
                /* Improve fragment distribution and reduce our average
                 * search time by starting our next search here. (see
                 * Knuth vol 1, sec 2.5, pg 449) */
-               if ( != prev->next)
+               if (prev != free_slob_pages.prev &&
+                      != prev->next)
                        list_move_tail(&free_slob_pages, prev->next);
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at

Reply via email to