From: Aaron Tomlin <atomlin@redhat.com>
Date: Fri, 26 Apr 2013 15:15:34 +0000 (+0100)
Subject: mm: slab: Verify the nodeid passed to ____cache_alloc_node
X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=14e50c6a9bc2b283bb4021026226268312ceefdd;p=GitHub%2FLineageOS%2Fandroid_kernel_motorola_exynos9610.git

mm: slab: Verify the nodeid passed to ____cache_alloc_node

If the nodeid is > num_online_nodes() this can cause an Oops and a
panic(). The purpose of this patch is to assert if this condition is
true to aid debugging efforts rather than some random NULL pointer
dereference or page fault.

This patch is in response to BZ#42967 [1].  Using VM_BUG_ON so it's used
only when CONFIG_DEBUG_VM is set, given that ____cache_alloc_node() is a
hot code path.

[1]: https://bugzilla.kernel.org/show_bug.cgi?id=42967

Signed-off-by: Aaron Tomlin <atomlin@redhat.com>
Reviewed-by: Rik van Riel <riel@redhat.com>
Acked-by: Christoph Lameter <cl@linux.com>
Acked-by: Rafael Aquini <aquini@redhat.com>
Acked-by: David Rientjes <rientjes@google.com>
Signed-off-by: Pekka Enberg <penberg@kernel.org>
---

diff --git a/mm/slab.c b/mm/slab.c
index 910df6326831..a98f8db93670 100644
--- a/mm/slab.c
+++ b/mm/slab.c
@@ -3289,6 +3289,7 @@ static void *____cache_alloc_node(struct kmem_cache *cachep, gfp_t flags,
 	void *obj;
 	int x;
 
+	VM_BUG_ON(nodeid > num_online_nodes());
 	n = cachep->node[nodeid];
 	BUG_ON(!n);