korg/linux
0
0
Fork 0
mirror of https://mirrors.bfsu.edu.cn/git/linux.git synced 2024-11-11 12:28:41 +08:00
Code Issues Packages Projects Releases Wiki Activity

slub: fix/clean free_debug_processing return paths

Browse Source 
Since commit 19c7ff9ecd ("slub: Take node lock during object free
checks") check_object has been incorrectly returning success as it
follows the out label which just returns the node.

Thanks to refactoring, the out and fail paths are now basically the
same.  Combine the two into one and just use a single label.

Credit to Mathias Krause for the original work which inspired this
series

Signed-off-by: Laura Abbott <labbott@fedoraproject.org>
Acked-by: Christoph Lameter <cl@linux.com>
Cc: Pekka Enberg <penberg@kernel.org>
Cc: David Rientjes <rientjes@google.com>
Cc: Joonsoo Kim <js1304@gmail.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Mathias Krause <minipli@googlemail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This commit is contained in:
Laura Abbott 2016-03-15 14:55:02 -07:00 committed by Linus Torvalds
parent 282acb4361
commit 804aa132d3
1 changed files with 10 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
mm/slub.c
View File

@ -1053,24 +1053,25 @@ static noinline int free_debug_processing(
void *object = head;
int cnt = 0;
unsigned long uninitialized_var(flags);
int ret = 0;
spin_lock_irqsave(&n->list_lock, flags);
slab_lock(page);
if (!check_slab(s, page))
goto fail;
goto out;
next_object:
cnt++;
if (!check_valid_pointer(s, page, object)) {
slab_err(s, page, "Invalid object pointer 0x%p", object);
goto fail;
goto out;
}
if (on_freelist(s, page, object)) {
object_err(s, page, object, "Object already free");
goto fail;
goto out;
}
if (!check_object(s, page, object, SLUB_RED_ACTIVE))
@ -1087,7 +1088,7 @@ next_object:
} else
object_err(s, page, object,
"page slab pointer corrupt.");
goto fail;
goto out;
}
if (s->flags & SLAB_STORE_USER)
@ -1101,6 +1102,8 @@ next_object:
object = get_freepointer(s, object);
goto next_object;
}
ret = 1;
out:
if (cnt != bulk_cnt)
slab_err(s, page, "Bulk freelist count(%d) invalid(%d)\n",
@ -1108,13 +1111,9 @@ out:
slab_unlock(page);
spin_unlock_irqrestore(&n->list_lock, flags);
return 1;
fail:
slab_unlock(page);
spin_unlock_irqrestore(&n->list_lock, flags);
slab_fix(s, "Object at 0x%p not freed", object);
return 0;
if (!ret)
slab_fix(s, "Object at 0x%p not freed", object);
return ret;
}
static int __init setup_slub_debug(char *str)