mirror of
https://github.com/team-infusion-developers/android_kernel_samsung_msm8976.git
synced 2024-09-30 00:34:35 +00:00
d9024df02f
There is a potential bug in __lmb_alloc_base where we subtract `size' from the base address of a reserved region without checking whether the subtraction could wrap around and produce a very large unsigned value. In fact it probably isn't possible to hit the bug in practice since it would only occur in the situation where we can't satisfy the allocation request and there is a reserved region starting at 0. This fixes the potential bug by breaking out of the loop when we get to the point where the base of the reserved region is less than the size requested. This also restructures the loop to be a bit easier to follow. The same logic got copied into lmb_alloc_nid_unreserved, so this makes a similar change there. Here the bug is more likely to be hit because the outer loop (in lmb_alloc_nid) goes through the memory regions in increasing order rather than decreasing order as __lmb_alloc_base does, and we are therefore more likely to hit the case where we are testing against a reserved region with a base address of 0. Signed-off-by: Paul Mackerras <paulus@samba.org> |
||
|---|---|---|
| .. | ||
| lzo | ||
| reed_solomon | ||
| zlib_deflate | ||
| zlib_inflate | ||
| .gitignore | ||
| argv_split.c | ||
| audit.c | ||
| bitmap.c | ||
| bitrev.c | ||
| bug.c | ||
| bust_spinlocks.c | ||
| check_signature.c | ||
| cmdline.c | ||
| cpumask.c | ||
| crc-ccitt.c | ||
| crc-itu-t.c | ||
| crc7.c | ||
| crc16.c | ||
| crc32.c | ||
| crc32defs.h | ||
| ctype.c | ||
| debug_locks.c | ||
| dec_and_lock.c | ||
| devres.c | ||
| div64.c | ||
| dump_stack.c | ||
| extable.c | ||
| fault-inject.c | ||
| find_next_bit.c | ||
| gen_crc32table.c | ||
| genalloc.c | ||
| halfmd4.c | ||
| hexdump.c | ||
| hweight.c | ||
| idr.c | ||
| inflate.c | ||
| int_sqrt.c | ||
| iomap.c | ||
| iomap_copy.c | ||
| iommu-helper.c | ||
| ioremap.c | ||
| irq_regs.c | ||
| kasprintf.c | ||
| Kconfig | ||
| Kconfig.debug | ||
| kernel_lock.c | ||
| klist.c | ||
| kobject.c | ||
| kobject_uevent.c | ||
| kref.c | ||
| libcrc32c.c | ||
| list_debug.c | ||
| lmb.c | ||
| locking-selftest-hardirq.h | ||
| locking-selftest-mutex.h | ||
| locking-selftest-rlock-hardirq.h | ||
| locking-selftest-rlock-softirq.h | ||
| locking-selftest-rlock.h | ||
| locking-selftest-rsem.h | ||
| locking-selftest-softirq.h | ||
| locking-selftest-spin-hardirq.h | ||
| locking-selftest-spin-softirq.h | ||
| locking-selftest-spin.h | ||
| locking-selftest-wlock-hardirq.h | ||
| locking-selftest-wlock-softirq.h | ||
| locking-selftest-wlock.h | ||
| locking-selftest-wsem.h | ||
| locking-selftest.c | ||
| Makefile | ||
| parser.c | ||
| pcounter.c | ||
| percpu_counter.c | ||
| plist.c | ||
| prio_heap.c | ||
| prio_tree.c | ||
| proportions.c | ||
| radix-tree.c | ||
| random32.c | ||
| rbtree.c | ||
| reciprocal_div.c | ||
| rwsem-spinlock.c | ||
| rwsem.c | ||
| scatterlist.c | ||
| semaphore-sleepers.c | ||
| sha1.c | ||
| smp_processor_id.c | ||
| sort.c | ||
| spinlock_debug.c | ||
| string.c | ||
| swiotlb.c | ||
| textsearch.c | ||
| ts_bm.c | ||
| ts_fsm.c | ||
| ts_kmp.c | ||
| vsprintf.c | ||