aboutsummaryrefslogtreecommitdiffstats
path: root/arch/powerpc/lib
diff options
context:
space:
mode:
authorTimur Tabi <timur@freescale.com>2007-01-27 18:41:49 -0500
committerPaul Mackerras <paulus@samba.org>2007-02-06 22:03:19 -0500
commit4942bd80e83d13bf394df4a8109bee39d861820f (patch)
tree894ec8480e5dbffe59fe8fa798c50f44d174a8b1 /arch/powerpc/lib
parent5f3162f0664be49c72c1e6ce4a46848f9d96d790 (diff)
[POWERPC] Fix array indexing error in rheap grow()
The grow() function in the rheap library allocates a larger array of blocks, copies the contents of the old blocks array to the newly allocated array and fixes the list_head pointers after the copy. At the end, the new blocks must be enqueued to the empty_list of the rh_info_t structure. This patch fixes a bug where the code was indexing past the end of the array when enqueueing blocks. The UCC ethernet driver, which uses the rheap allocator, experiences kernel panics because of this bug. Signed-off-by: Ionut Nicu <ionut.nicu@freescale.com> Signed-off-by: Timur Tabi <timur@freescale.com> Signed-off-by: Paul Mackerras <paulus@samba.org>
Diffstat (limited to 'arch/powerpc/lib')
-rw-r--r--arch/powerpc/lib/rheap.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/arch/powerpc/lib/rheap.c b/arch/powerpc/lib/rheap.c
index 57bf991ccd6e..4bbda6b2be45 100644
--- a/arch/powerpc/lib/rheap.c
+++ b/arch/powerpc/lib/rheap.c
@@ -85,7 +85,8 @@ static int grow(rh_info_t * info, int max_blocks)
85 info->flags &= ~RHIF_STATIC_BLOCK; 85 info->flags &= ~RHIF_STATIC_BLOCK;
86 86
87 /* add all new blocks to the free list */ 87 /* add all new blocks to the free list */
88 for (i = 0, blk = block + info->max_blocks; i < new_blocks; i++, blk++) 88 blk = block + info->max_blocks - new_blocks;
89 for (i = 0; i < new_blocks; i++, blk++)
89 list_add(&blk->list, &info->empty_list); 90 list_add(&blk->list, &info->empty_list);
90 91
91 return 0; 92 return 0;