From ef8b4520bd9f8294ffce9abd6158085bde5dc902 Mon Sep 17 00:00:00 2001 From: Christoph Lameter Date: Tue, 16 Oct 2007 01:24:46 -0700 Subject: [PATCH] Slab allocators: fail if ksize is called with a NULL parameter A NULL pointer means that the object was not allocated. One cannot determine the size of an object that has not been allocated. Currently we return 0 but we really should BUG() on attempts to determine the size of something nonexistent. krealloc() interprets NULL to mean a zero sized object. Handle that separately in krealloc(). Signed-off-by: Christoph Lameter Acked-by: Pekka Enberg Cc: Matt Mackall Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- mm/slab.c | 3 ++- mm/slob.c | 3 ++- mm/slub.c | 3 ++- mm/util.c | 6 ++++-- 4 files changed, 10 insertions(+), 5 deletions(-) diff --git a/mm/slab.c b/mm/slab.c index 6f6abef83a1..1b240a3029d 100644 --- a/mm/slab.c +++ b/mm/slab.c @@ -4446,7 +4446,8 @@ const struct seq_operations slabstats_op = { */ size_t ksize(const void *objp) { - if (unlikely(ZERO_OR_NULL_PTR(objp))) + BUG_ON(!objp); + if (unlikely(objp == ZERO_SIZE_PTR)) return 0; return obj_size(virt_to_cache(objp)); diff --git a/mm/slob.c b/mm/slob.c index a886e83e17e..de5d5563a46 100644 --- a/mm/slob.c +++ b/mm/slob.c @@ -484,7 +484,8 @@ size_t ksize(const void *block) { struct slob_page *sp; - if (unlikely(ZERO_OR_NULL_PTR(block))) + BUG_ON(!block); + if (unlikely(block == ZERO_SIZE_PTR)) return 0; sp = (struct slob_page *)virt_to_page(block); diff --git a/mm/slub.c b/mm/slub.c index b7d3664fa3a..d7c044dbd15 100644 --- a/mm/slub.c +++ b/mm/slub.c @@ -2449,7 +2449,8 @@ size_t ksize(const void *object) struct page *page; struct kmem_cache *s; - if (unlikely(ZERO_OR_NULL_PTR(object))) + BUG_ON(!object); + if (unlikely(object == ZERO_SIZE_PTR)) return 0; page = get_object_page(object); diff --git a/mm/util.c b/mm/util.c index bf340d80686..5f64026cbb4 100644 --- a/mm/util.c +++ b/mm/util.c @@ -81,14 +81,16 @@ EXPORT_SYMBOL(kmemdup); void *krealloc(const void *p, size_t new_size, gfp_t flags) { void *ret; - size_t ks; + size_t ks = 0; if (unlikely(!new_size)) { kfree(p); return ZERO_SIZE_PTR; } - ks = ksize(p); + if (p) + ks = ksize(p); + if (ks >= new_size) return (void *)p; -- 2.20.1