Commit 714b8171 authored May 06, 2007 by Pekka Enberg Committed by Linus Torvalds May 07, 2007

slab: ensure cache_alloc_refill terminates

If slab->inuse is corrupted, cache_alloc_refill can enter an infinite
loop as detailed by Michael Richardson in the following post:
<http://lkml.org/lkml/2007/2/16/292

>. This adds a BUG_ON to catch
those cases.

Cc: Michael Richardson <mcr@sandelman.ca>
Acked-by: Christoph Lameter <clameter@sgi.com>
Signed-off-by: Pekka Enberg <penberg@cs.helsinki.fi>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

parent 5f22df00

mm/slab.c

+8 −0

Original line number	Diff line number	Diff line
		@@ -2990,6 +2990,14 @@ retry:
		slabp = list_entry(entry, struct slab, list);
		check_slabp(cachep, slabp);
		check_spinlock_acquired(cachep);

		/*
		* The slab was either on partial or free list so
		* there must be at least one object available for
		* allocation.
		*/
		BUG_ON(slabp->inuse < 0 \|\| slabp->inuse >= cachep->num);

		while (slabp->inuse < cachep->num && batchcount--) {
		STATS_INC_ALLOCED(cachep);
		STATS_INC_ACTIVE(cachep);

Admin message