Re: [BUG] SLOB's krealloc() seems bust

[Linus Torvalds]

On Tue, 7 Oct 2008, Matt Mackall wrote:
>
> Thanks, Peter. I know we're way late in the 2.6.27 cycle, so I'll leave
> it to Linus and Andrew to decide how to queue this up.

Well, since it seems to be clearly broken without it, I'd take it, but now 
I'm kind of waiting for the resolution on whether that second "-1" is 
correct or not.

>From a quick look at mm/slob.c I see Pekka's point that ->units does look 
like the real size in units, not the "size plus header", and that the 
second -1 may be bogus.

But I don't know the code.

Peter - can you check with that

>  	if (slob_page(sp))
> -		return ((slob_t *)block - 1)->units + SLOB_UNIT;
> +		return (((slob_t *)block - 1)->units - 1) * SLOB_UNIT;

thing using

-		return ((slob_t *)block - 1)->units + SLOB_UNIT;
+		return ((slob_t *)block - 1)->units * SLOB_UNIT;

instead? 

		Linus
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/