aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--mm/slab.c32
1 files changed, 23 insertions, 9 deletions
diff --git a/mm/slab.c b/mm/slab.c
index 54bd2eb3f2f6..2046da2aa46e 100644
--- a/mm/slab.c
+++ b/mm/slab.c
@@ -2636,6 +2636,28 @@ static void kfree_debugcheck(const void *objp)
2636 } 2636 }
2637} 2637}
2638 2638
2639static inline void verify_redzone_free(struct kmem_cache *cache, void *obj)
2640{
2641 unsigned long redzone1, redzone2;
2642
2643 redzone1 = *dbg_redzone1(cache, obj);
2644 redzone2 = *dbg_redzone2(cache, obj);
2645
2646 /*
2647 * Redzone is ok.
2648 */
2649 if (redzone1 == RED_ACTIVE && redzone2 == RED_ACTIVE)
2650 return;
2651
2652 if (redzone1 == RED_INACTIVE && redzone2 == RED_INACTIVE)
2653 slab_error(cache, "double free detected");
2654 else
2655 slab_error(cache, "memory outside object was overwritten");
2656
2657 printk(KERN_ERR "%p: redzone 1:0x%lx, redzone 2:0x%lx.\n",
2658 obj, redzone1, redzone2);
2659}
2660
2639static void *cache_free_debugcheck(struct kmem_cache *cachep, void *objp, 2661static void *cache_free_debugcheck(struct kmem_cache *cachep, void *objp,
2640 void *caller) 2662 void *caller)
2641{ 2663{
@@ -2659,15 +2681,7 @@ static void *cache_free_debugcheck(struct kmem_cache *cachep, void *objp,
2659 slabp = page_get_slab(page); 2681 slabp = page_get_slab(page);
2660 2682
2661 if (cachep->flags & SLAB_RED_ZONE) { 2683 if (cachep->flags & SLAB_RED_ZONE) {
2662 if (*dbg_redzone1(cachep, objp) != RED_ACTIVE || 2684 verify_redzone_free(cachep, objp);
2663 *dbg_redzone2(cachep, objp) != RED_ACTIVE) {
2664 slab_error(cachep, "double free, or memory outside"
2665 " object was overwritten");
2666 printk(KERN_ERR "%p: redzone 1:0x%lx, "
2667 "redzone 2:0x%lx.\n",
2668 objp, *dbg_redzone1(cachep, objp),
2669 *dbg_redzone2(cachep, objp));
2670 }
2671 *dbg_redzone1(cachep, objp) = RED_INACTIVE; 2685 *dbg_redzone1(cachep, objp) = RED_INACTIVE;
2672 *dbg_redzone2(cachep, objp) = RED_INACTIVE; 2686 *dbg_redzone2(cachep, objp) = RED_INACTIVE;
2673 } 2687 }