Commit 4942bd80 authored by Timur Tabi's avatar Timur Tabi Committed by Paul Mackerras

[POWERPC] Fix array indexing error in rheap grow()

The grow() function in the rheap library allocates a larger array of blocks,
copies the contents of the old blocks array to the newly allocated array and
fixes the list_head pointers after the copy.  At the end, the new blocks must
be enqueued to the empty_list of the rh_info_t structure.  This patch fixes
a bug where the code was indexing past the end of the array when enqueueing
blocks.  The UCC ethernet driver, which uses the rheap allocator, experiences
kernel panics because of this bug.
Signed-off-by: default avatarIonut Nicu <ionut.nicu@freescale.com>
Signed-off-by: default avatarTimur Tabi <timur@freescale.com>
Signed-off-by: default avatarPaul Mackerras <paulus@samba.org>
parent 5f3162f0
...@@ -85,7 +85,8 @@ static int grow(rh_info_t * info, int max_blocks) ...@@ -85,7 +85,8 @@ static int grow(rh_info_t * info, int max_blocks)
info->flags &= ~RHIF_STATIC_BLOCK; info->flags &= ~RHIF_STATIC_BLOCK;
/* add all new blocks to the free list */ /* add all new blocks to the free list */
for (i = 0, blk = block + info->max_blocks; i < new_blocks; i++, blk++) blk = block + info->max_blocks - new_blocks;
for (i = 0; i < new_blocks; i++, blk++)
list_add(&blk->list, &info->empty_list); list_add(&blk->list, &info->empty_list);
return 0; return 0;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment