diff options
| author | David Miller <davem@davemloft.net> | 2014-05-05 16:20:04 -0400 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2014-05-05 20:38:49 -0700 |
| commit | 30321c7b658a5661eea715b33e82a5fd3e33e180 (patch) | |
| tree | b317c985e9b3b741ef1c54a420172ea692a297cc /mm/slab.c | |
| parent | 7cc68973c36d92c493fc07ff38df6347f85a532e (diff) | |
| download | linux-stable-30321c7b658a5661eea715b33e82a5fd3e33e180.tar.gz linux-stable-30321c7b658a5661eea715b33e82a5fd3e33e180.tar.bz2 linux-stable-30321c7b658a5661eea715b33e82a5fd3e33e180.zip | |
slab: Fix off by one in object max number tests.
If freelist_idx_t is a byte, SLAB_OBJ_MAX_NUM should be 255 not 256, and
likewise if freelist_idx_t is a short, then it should be 65535 not
65536.
This was leading to all kinds of random crashes on sparc64 where
PAGE_SIZE is 8192. One problem shown was that if spinlock debugging was
enabled, we'd get deadlocks in copy_pte_range() or do_wp_page() with the
same cpu already holding a lock it shouldn't hold, or the lock belonging
to a completely unrelated process.
Fixes: a41adfaa23df ("slab: introduce byte sized index for the freelist of a slab")
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'mm/slab.c')
| -rw-r--r-- | mm/slab.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/mm/slab.c b/mm/slab.c index d7f9f4494054..19d92181ce24 100644 --- a/mm/slab.c +++ b/mm/slab.c @@ -166,7 +166,7 @@ typedef unsigned char freelist_idx_t; typedef unsigned short freelist_idx_t; #endif -#define SLAB_OBJ_MAX_NUM (1 << sizeof(freelist_idx_t) * BITS_PER_BYTE) +#define SLAB_OBJ_MAX_NUM ((1 << sizeof(freelist_idx_t) * BITS_PER_BYTE) - 1) /* * true if a page was allocated from pfmemalloc reserves for network-based |