slab: ensure cache_alloc_refill terminates
If slab->inuse is corrupted, cache_alloc_refill can enter an infinite loop as detailed by Michael Richardson in the following post: <http://lkml.org/lkml/2007/2/16/292>. This adds a BUG_ON to catch those cases. Cc: Michael Richardson <mcr@sandelman.ca> Acked-by: Christoph Lameter <clameter@sgi.com> Signed-off-by: Pekka Enberg <penberg@cs.helsinki.fi> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This commit is contained in:
parent
5f22df00a0
commit
714b8171af
|
@ -2990,6 +2990,14 @@ retry:
|
|||
slabp = list_entry(entry, struct slab, list);
|
||||
check_slabp(cachep, slabp);
|
||||
check_spinlock_acquired(cachep);
|
||||
|
||||
/*
|
||||
* The slab was either on partial or free list so
|
||||
* there must be at least one object available for
|
||||
* allocation.
|
||||
*/
|
||||
BUG_ON(slabp->inuse < 0 || slabp->inuse >= cachep->num);
|
||||
|
||||
while (slabp->inuse < cachep->num && batchcount--) {
|
||||
STATS_INC_ALLOCED(cachep);
|
||||
STATS_INC_ACTIVE(cachep);
|
||||
|
|
Loading…
Reference in New Issue