From: Pekka Enberg <penberg@cs.helsinki.fi>
Date: Sun, 6 May 2007 21:49:03 +0000 (-0700)
Subject: slab: ensure cache_alloc_refill terminates
X-Git-Tag: v2.6.22-rc1~992
X-Git-Url: http://pilppa.com/gitweb/?a=commitdiff_plain;h=714b8171af9c930a59a0da8f6fe50518e70ab035;p=linux-2.6-omap-h63xx.git

slab: ensure cache_alloc_refill terminates

If slab->inuse is corrupted, cache_alloc_refill can enter an infinite
loop as detailed by Michael Richardson in the following post:
<http://lkml.org/lkml/2007/2/16/292>. This adds a BUG_ON to catch
those cases.

Cc: Michael Richardson <mcr@sandelman.ca>
Acked-by: Christoph Lameter <clameter@sgi.com>
Signed-off-by: Pekka Enberg <penberg@cs.helsinki.fi>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
---

diff --git a/mm/slab.c b/mm/slab.c
index 8b71a9c3daa..21b2aef2525 100644
--- a/mm/slab.c
+++ b/mm/slab.c
@@ -2990,6 +2990,14 @@ retry:
 		slabp = list_entry(entry, struct slab, list);
 		check_slabp(cachep, slabp);
 		check_spinlock_acquired(cachep);
+
+		/*
+		 * The slab was either on partial or free list so
+		 * there must be at least one object available for
+		 * allocation.
+		 */
+		BUG_ON(slabp->inuse < 0 || slabp->inuse >= cachep->num);
+
 		while (slabp->inuse < cachep->num && batchcount--) {
 			STATS_INC_ALLOCED(cachep);
 			STATS_INC_ACTIVE(cachep);