[PATCH] Fix corruption error in rh_alloc_fixed()

[Guillaume Knispel]

On Tue, 09 Dec 2008 09:16:50 -0600
Timur Tabi <timur at freescale.com> wrote:

> Guillaume Knispel wrote:
> 
> > blk = NULL; at the end of the loop is what is done in the more used
> > rh_alloc_align(), so for consistency either we change both or we use
> > the same construction here.
> > I also think that testing for &info->free_list is harder to understand
> > because you must have the linked list implementation in your head
> > (which a kernel developer should anyway so this is not so important)
> 
> Fair enough.
> 
> Acked-by: Timur Tabi <timur at freescale.com>
> 

Kumar, can this go into your tree ?
(copying the patch under so you have it at hand)

There is an error in rh_alloc_fixed() of the Remote Heap code:
If there is at least one free block blk won't be NULL at the end of the
search loop, so -ENOMEM won't be returned and the else branch of
"if (bs == s || be == e)" will be taken, corrupting the management
structures.

Signed-off-by: Guillaume Knispel <gknispel at proformatique.com>
---
Fix an error in rh_alloc_fixed() that made allocations succeed when
they should fail, and corrupted management structures.

diff --git a/arch/powerpc/lib/rheap.c b/arch/powerpc/lib/rheap.c
index 29b2941..45907c1 100644
--- a/arch/powerpc/lib/rheap.c
+++ b/arch/powerpc/lib/rheap.c
@@ -556,6 +556,7 @@ unsigned long rh_alloc_fixed(rh_info_t * info, unsigned long start, int size, co
 		be = blk->start + blk->size;
 		if (s >= bs && e <= be)
 			break;
+		blk = NULL;
 	}
 
 	if (blk == NULL)

-- 
Guillaume KNISPEL