The patch titled mm: vmap fix overflow has been removed from the -mm tree. Its filename was mm-vmap-fix-overflow.patch This patch was dropped because it was merged into mainline or a subsystem tree The current -mm tree may be found at http://userweb.kernel.org/~akpm/mmotm/ ------------------------------------------------------ Subject: mm: vmap fix overflow From: Nick Piggin <npiggin@xxxxxxx> The new vmap allocator can wrap the address and get confused in the case of large allocations or VMALLOC_END near the end of address space. Problem reported by Christoph Hellwig on a 32-bit XFS workload. Signed-off-by: Nick Piggin <npiggin@xxxxxxx> Reported-by: Christoph Hellwig <hch@xxxxxx> Cc: <stable@xxxxxxxxxx> [2.6.28.x] Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> --- mm/vmalloc.c | 7 +++++++ 1 file changed, 7 insertions(+) diff -puN mm/vmalloc.c~mm-vmap-fix-overflow mm/vmalloc.c --- a/mm/vmalloc.c~mm-vmap-fix-overflow +++ a/mm/vmalloc.c @@ -323,6 +323,7 @@ static struct vmap_area *alloc_vmap_area unsigned long addr; int purged = 0; + BUG_ON(!size); BUG_ON(size & ~PAGE_MASK); va = kmalloc_node(sizeof(struct vmap_area), @@ -334,6 +335,9 @@ retry: addr = ALIGN(vstart, align); spin_lock(&vmap_area_lock); + if (addr + size - 1 < addr) + goto overflow; + /* XXX: could have a last_hole cache */ n = vmap_area_root.rb_node; if (n) { @@ -365,6 +369,8 @@ retry: while (addr + size > first->va_start && addr + size <= vend) { addr = ALIGN(first->va_end + PAGE_SIZE, align); + if (addr + size - 1 < addr) + goto overflow; n = rb_next(&first->rb_node); if (n) @@ -375,6 +381,7 @@ retry: } found: if (addr + size > vend) { +overflow: spin_unlock(&vmap_area_lock); if (!purged) { purge_vmap_area_lazy(); _ Patches currently in -mm which might be from npiggin@xxxxxxx are origin.patch linux-next.patch vmap-remove-needless-lock-and-list-in-vmap.patch page_fault-retry-with-nopage_retry.patch page_fault-retry-with-nopage_retry-fix.patch radix-tree-gang-set-if-tagged-operation.patch mm-dont-call-mark_page_accessed-in-do_swap_page.patch mm-update_page_reclaim_stat-is-called-from-page-fault-path.patch mm-add-comment-why-mark_page_accessed-would-be-better-than-pte_mkyoung-in-follow_page.patch mm-add-comment-why-mark_page_accessed-would-be-better-than-pte_mkyoung-in-follow_page-fix.patch reiser4.patch fs-symlink-write_begin-allocation-context-fix-reiser4-fix.patch -- To unsubscribe from this list: send the line "unsubscribe mm-commits" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html