boundary condition bug fix for vmalloc()

[kanoj@google.engr.sgi.com (Kanoj Sarcar)]

Hi,

Under heavy load conditions, get_vm_area() might end up allocating an
address range beyond VMALLOC_END. The problem is after the for loop
in get_vm_area() terminates, no consistency check (addr > VMALLOC_END
- size) is performed on the "addr". 

I believe the following patch will fix the problem:

--- vmalloc.old		Wed Apr 21 16:52:05 1999
+++ mm/vmalloc.c	Wed Apr 21 16:53:08 1999
@@ -161,11 +161,11 @@
        for (p = &vmlist; (tmp = *p) ; p = &tmp->next) {
                if (size + addr < (unsigned long) tmp->addr)
                        break;
+               addr = tmp->size + (unsigned long) tmp->addr;
                if (addr > VMALLOC_END-size) {
                        kfree(area);
                        return NULL;
                }
-               addr = tmp->size + (unsigned long) tmp->addr;
        }
        area->addr = (void *)addr;
        area->size = size + PAGE_SIZE;
 
Please let me know if this patch is pulled into the source tree, 
so I can update my tree.

Thanks.

Kanoj
kanoj@engr.sgi.com
--
To unsubscribe, send a message with 'unsubscribe linux-mm my@address'
in the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://humbolt.geo.uu.nl/Linux-MM/