openkylin
/
linux
mirror of https://gitee.com/openkylin/linux.git
9
0
Fork 0
Code Issues Projects Releases Wiki Activity

staging: zcache: fix memory corruption bug 

This patch fixes a bug where the zv code writes before the allocated
buffer, resulting in system memory corruption. This was introduced
during the switch from xvmalloc to zsmalloc.

Signed-off-by: Seth Jennings <sjenning@linux.vnet.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Seth Jennings 2012-02-28 16:02:23 -06:00 committed by Greg Kroah-Hartman
parent 843c666d16
commit 041aba19b9
1 changed files with 2 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
drivers/staging/zcache/zcache-main.c
View File

@ -701,7 +701,6 @@ static struct zv_hdr *zv_create(struct zs_pool *pool, uint32_t pool_id,
u32 size = clen + sizeof(struct zv_hdr); u32 size = clen + sizeof(struct zv_hdr);
int chunks = (size + (CHUNK_SIZE - 1)) >> CHUNK_SHIFT; int chunks = (size + (CHUNK_SIZE - 1)) >> CHUNK_SHIFT;
void *handle = NULL; void *handle = NULL;
char *buf;
BUG_ON(!irqs_disabled()); BUG_ON(!irqs_disabled());
BUG_ON(chunks >= NCHUNKS); BUG_ON(chunks >= NCHUNKS);
@ -710,14 +709,13 @@ static struct zv_hdr *zv_create(struct zs_pool *pool, uint32_t pool_id,
goto out; goto out;
atomic_inc(&zv_curr_dist_counts[chunks]); atomic_inc(&zv_curr_dist_counts[chunks]);
atomic_inc(&zv_cumul_dist_counts[chunks]); atomic_inc(&zv_cumul_dist_counts[chunks]);
zv = (struct zv_hdr *)((char *)cdata - sizeof(*zv)); zv = zs_map_object(pool, handle);
zv->index = index; zv->index = index;
zv->oid = *oid; zv->oid = *oid;
zv->pool_id = pool_id; zv->pool_id = pool_id;
zv->size = clen; zv->size = clen;
SET_SENTINEL(zv, ZVH); SET_SENTINEL(zv, ZVH);
buf = zs_map_object(pool, handle); memcpy((char *)zv + sizeof(struct zv_hdr), cdata, clen);
memcpy(buf, zv, clen + sizeof(*zv));
zs_unmap_object(pool, handle); zs_unmap_object(pool, handle);
out: out:
return handle; return handle;