[PATCH] slub: Fix Off-By-One in the While condition in on_freelist()
From: Lilitha Persefoni Gkini
Date: Sat Feb 15 2025 - 11:57:12 EST
The condition `nr <= slab->objects` in the `on_freelist()` serves as
bound while walking through the `freelist` linked list because we can't
have more free objects than the maximum amount of objects in the slab.
But the `=` can result in an extra unnecessary iteration.
The patch changes it to `nr < slab->objects` to ensure it iterates
at most `slab->objects` number of times.
Signed-off-by: Lilitha Persefoni Gkini <lilithpgkini@xxxxxxxxx>
---
mm/slub.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/mm/slub.c b/mm/slub.c
index 1f50129dcfb3..ad42450d4b0f 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -1435,7 +1435,7 @@ static int on_freelist(struct kmem_cache *s, struct slab *slab, void *search)
int max_objects;
fp = slab->freelist;
- while (fp && nr <= slab->objects) {
+ while (fp && nr < slab->objects) {
if (fp == search)
return 1;
if (!check_valid_pointer(s, slab, fp)) {
--
2.48.1