[PATCH] sys_select() kmallocs 0 bytes.

From: Dave Jones (dave@denial.force9.co.uk)
Date: Thu May 25 2000 - 14:45:54 EST


Note, the following bug exists in both pre10-3, and 2.2.16-4

 By including the following boobytrap patch to slab.c, I found that
we kmalloc 0 bytes a lot. Once a second in fact.
Some tracing around found sys_select() to be the culprit
in an off-by-one bug. (Fix at footer).

I've been armouring a few of the other allocation functions in similar
ways, which have caused a few triggers, but none have been as
prominent not as conclusive as this one. More to follow.

regards,

Dave.

diff -urN linux/mm/slab.c linux-10-3-dj/mm/slab.c
--- linux/mm/slab.c Thu May 25 01:07:02 2000
+++ linux-10-3-dj/mm/slab.c Thu May 25 19:39:28 2000
@@ -1687,6 +1687,11 @@
 {
         cache_sizes_t *csizep = cache_sizes;
 
+ if (size==0) {
+ printk("DEBUG: kmalloc() called with size==0 !! caller=%p\n",
+ __builtin_return_address(0));
+ }
+
         for (; csizep->cs_size; csizep++) {
                 if (size > csizep->cs_size)
                         continue;

diff -urN linux/fs/select.c linux-10-3-dj/fs/select.c
--- linux/fs/select.c Fri Apr 21 20:53:45 2000
+++ linux-10-3-dj/fs/select.c Thu May 25 20:18:44 2000
@@ -281,7 +281,7 @@
         }
 
         ret = -EINVAL;
- if (n < 0)
+ if (n <= 0)
                 goto out_nofds;
 
         if (n > current->files->max_fdset)

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/



This archive was generated by hypermail 2b29 : Wed May 31 2000 - 21:00:14 EST