summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorEric Dumazet <eric.dumazet@gmail.com>2011-12-13 04:57:06 +0100
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2012-02-20 12:48:14 -0800
commit16c7560fcca939095d099da4316f2df66aebc3ba (patch)
tree62c6ca33a6d17069cc9028ecce53e18a87526618
parentd3a6a79cfe7641d797ab74eea55b93e0f35f66d7 (diff)
downloadlwn-16c7560fcca939095d099da4316f2df66aebc3ba.tar.gz
lwn-16c7560fcca939095d099da4316f2df66aebc3ba.zip
slub: fix a possible memleak in __slab_alloc()
commit 73736e0387ba0e6d2b703407b4d26168d31516a7 upstream. Zhihua Che reported a possible memleak in slub allocator on CONFIG_PREEMPT=y builds. It is possible current thread migrates right before disabling irqs in __slab_alloc(). We must check again c->freelist, and perform a normal allocation instead of scratching c->freelist. Many thanks to Zhihua Che for spotting this bug, introduced in 2.6.39 V2: Its also possible an IRQ freed one (or several) object(s) and populated c->freelist, so its not a CONFIG_PREEMPT only problem. Reported-by: Zhihua Che <zhihua.che@gmail.com> Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Acked-by: Christoph Lameter <cl@linux.com> Signed-off-by: Pekka Enberg <penberg@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-rw-r--r--mm/slub.c6
1 files changed, 6 insertions, 0 deletions
diff --git a/mm/slub.c b/mm/slub.c
index 35f351f26193..0d0901ebaea2 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -1818,6 +1818,11 @@ static void *__slab_alloc(struct kmem_cache *s, gfp_t gfpflags, int node,
if (unlikely(!node_match(c, node)))
goto another_slab;
+ /* must check again c->freelist in case of cpu migration or IRQ */
+ object = c->freelist;
+ if (object)
+ goto update_freelist;
+
stat(s, ALLOC_REFILL);
load_freelist:
@@ -1827,6 +1832,7 @@ load_freelist:
if (kmem_cache_debug(s))
goto debug;
+update_freelist:
c->freelist = get_freepointer(s, object);
page->inuse = page->objects;
page->freelist = NULL;