On Wed, 21 Aug 2013 07:39:35 +0800 Wanpeng Li <liw...@linux.vnet.ibm.com> wrote:
> >Nope. If the error path is taken, free_pmds() will free uninitialised > >items from pmds[], which is a local in pgd_alloc() and contains random > >stack junk. The kernel will crash. > > > >You could pass an nr_pmds argument to free_pmds(), or zero out the > >remaining items on the error path. However, although the current code > >is a bit kooky, I don't see that it is harmful in any way. > > > > There is a check in free_pmds(): > > if (pmds[i]) > free_page((unsigned long)pmds[i]); > > which will avoid the issue you mentioned. pmds[i] is uninitialized. It gets allocated on the stack in pgd_alloc() and does not get zeroed. -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
