summaryrefslogtreecommitdiffstats
path: root/drivers/staging/zcache
diff options
context:
space:
mode:
authorSeth Jennings <sjenning@linux.vnet.ibm.com>2012-02-28 16:02:23 -0600
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2012-02-29 15:23:38 -0800
commit041aba19b916ddfd5254c80ef413ef8a7e76c8ad (patch)
treed85fb7795954cb4e59b361d98435983bb265a77a /drivers/staging/zcache
parent843c666d16e62e4b3889f1491a1d91b87ddc7bd3 (diff)
downloadlinux-041aba19b916ddfd5254c80ef413ef8a7e76c8ad.tar.bz2
staging: zcache: fix memory corruption bug
This patch fixes a bug where the zv code writes before the allocated buffer, resulting in system memory corruption. This was introduced during the switch from xvmalloc to zsmalloc. Signed-off-by: Seth Jennings <sjenning@linux.vnet.ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/staging/zcache')
-rw-r--r--drivers/staging/zcache/zcache-main.c6
1 files changed, 2 insertions, 4 deletions
diff --git a/drivers/staging/zcache/zcache-main.c b/drivers/staging/zcache/zcache-main.c
index 46c7c04c2451..70734652f724 100644
--- a/drivers/staging/zcache/zcache-main.c
+++ b/drivers/staging/zcache/zcache-main.c
@@ -701,7 +701,6 @@ static struct zv_hdr *zv_create(struct zs_pool *pool, uint32_t pool_id,
u32 size = clen + sizeof(struct zv_hdr);
int chunks = (size + (CHUNK_SIZE - 1)) >> CHUNK_SHIFT;
void *handle = NULL;
- char *buf;
BUG_ON(!irqs_disabled());
BUG_ON(chunks >= NCHUNKS);
@@ -710,14 +709,13 @@ static struct zv_hdr *zv_create(struct zs_pool *pool, uint32_t pool_id,
goto out;
atomic_inc(&zv_curr_dist_counts[chunks]);
atomic_inc(&zv_cumul_dist_counts[chunks]);
- zv = (struct zv_hdr *)((char *)cdata - sizeof(*zv));
+ zv = zs_map_object(pool, handle);
zv->index = index;
zv->oid = *oid;
zv->pool_id = pool_id;
zv->size = clen;
SET_SENTINEL(zv, ZVH);
- buf = zs_map_object(pool, handle);
- memcpy(buf, zv, clen + sizeof(*zv));
+ memcpy((char *)zv + sizeof(struct zv_hdr), cdata, clen);
zs_unmap_object(pool, handle);
out:
return handle;