slab: ensure cache_alloc_refill terminates

If slab->inuse is corrupted, cache_alloc_refill can enter an infinite loop as detailed by Michael Richardson in the following post: <http://lkml.org/lkml/2007/2/16/292>. This adds a BUG_ON to catch those cases. Cc: Michael Richardson <[email protected]> Acked-by: Christoph Lameter <[email protected]> Signed-off-by: Pekka Enberg <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
mgowda · May 7, 2007 · 714b817 · 714b817
1 parent 5f22df0
commit 714b817
Showing 1 changed file with 8 additions and 0 deletions.
diff --git a/mm/slab.c b/mm/slab.c
@@ -2990,6 +2990,14 @@ static void *cache_alloc_refill(struct kmem_cache *cachep, gfp_t flags)
 		slabp = list_entry(entry, struct slab, list);
 		check_slabp(cachep, slabp);
 		check_spinlock_acquired(cachep);
+
+		/*
+		 * The slab was either on partial or free list so
+		 * there must be at least one object available for
+		 * allocation.
+		 */
+		BUG_ON(slabp->inuse < 0 || slabp->inuse >= cachep->num);
+
 		while (slabp->inuse < cachep->num && batchcount--) {
 			STATS_INC_ALLOCED(cachep);
 			STATS_INC_ACTIVE(cachep);