Gitweb: http://git.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=714b8171af9c930a59a0da8f6fe50518e70ab035 Commit: 714b8171af9c930a59a0da8f6fe50518e70ab035 Parent: 5f22df00a009e3f86301366c0ecddb63ebd22af9 Author: Pekka Enberg <[EMAIL PROTECTED]> AuthorDate: Sun May 6 14:49:03 2007 -0700 Committer: Linus Torvalds <[EMAIL PROTECTED]> CommitDate: Mon May 7 12:12:51 2007 -0700
slab: ensure cache_alloc_refill terminates If slab->inuse is corrupted, cache_alloc_refill can enter an infinite loop as detailed by Michael Richardson in the following post: <http://lkml.org/lkml/2007/2/16/292>. This adds a BUG_ON to catch those cases. Cc: Michael Richardson <[EMAIL PROTECTED]> Acked-by: Christoph Lameter <[EMAIL PROTECTED]> Signed-off-by: Pekka Enberg <[EMAIL PROTECTED]> Signed-off-by: Andrew Morton <[EMAIL PROTECTED]> Signed-off-by: Linus Torvalds <[EMAIL PROTECTED]> --- mm/slab.c | 8 ++++++++ 1 files changed, 8 insertions(+), 0 deletions(-) diff --git a/mm/slab.c b/mm/slab.c index 8b71a9c..21b2aef 100644 --- a/mm/slab.c +++ b/mm/slab.c @@ -2990,6 +2990,14 @@ retry: slabp = list_entry(entry, struct slab, list); check_slabp(cachep, slabp); check_spinlock_acquired(cachep); + + /* + * The slab was either on partial or free list so + * there must be at least one object available for + * allocation. + */ + BUG_ON(slabp->inuse < 0 || slabp->inuse >= cachep->num); + while (slabp->inuse < cachep->num && batchcount--) { STATS_INC_ALLOCED(cachep); STATS_INC_ACTIVE(cachep); - To unsubscribe from this list: send the line "unsubscribe git-commits-head" in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html