Login
[x]
Log in using an account from:
Fedora Account System
Red Hat Associate
Red Hat Customer
Or login using a Red Hat Bugzilla account
Forgot Password
Login:
Hide Forgot
Create an Account
Red Hat Bugzilla – Attachment 315715 Details for
Bug 461082
CVE-2007-6716 kernel: dio: zero struct dio with kzalloc instead of manually
[?]
New
Simple Search
Advanced Search
My Links
Browse
Requests
Reports
Current State
Search
Tabular reports
Graphical reports
Duplicates
Other Reports
User Changes
Plotly Reports
Bug Status
Bug Severity
Non-Defaults
|
Product Dashboard
Help
Page Help!
Bug Writing Guidelines
What's new
Browser Support Policy
5.0.4.rh83 Release notes
FAQ
Guides index
User guide
Web Services
Contact
Legal
This site requires JavaScript to be enabled to function correctly, please enable it.
[patch]
Upstream patch for this issue
0001-dio-zero-struct-dio-with-kzalloc-instead-of-manuall.patch (text/plain), 2.89 KB, created by
Eugene Teo (Security Response)
on 2008-09-04 02:43:32 UTC
(
hide
)
Description:
Upstream patch for this issue
Filename:
MIME Type:
Creator:
Eugene Teo (Security Response)
Created:
2008-09-04 02:43:32 UTC
Size:
2.89 KB
patch
obsolete
>From 848c4dd5153c7a0de55470ce99a8e13a63b4703f Mon Sep 17 00:00:00 2001 >From: Zach Brown <zach.brown@oracle.com> >Date: Mon, 20 Aug 2007 17:12:01 -0700 >Subject: [PATCH] dio: zero struct dio with kzalloc instead of manually > >This patch uses kzalloc to zero all of struct dio rather than manually >trying to track which fields we rely on being zero. It passed aio+dio >stress testing and some bug regression testing on ext3. > >This patch was introduced by Linus in the conversation that lead up to >Badari's minimal fix to manually zero .map_bh.b_state in commit: > > 6a648fa72161d1f6468dabd96c5d3c0db04f598a > >It makes the code a bit smaller. Maybe a couple fewer cachelines to >load, if we're lucky: > > text data bss dec hex filename >3285925 568506 1304616 5159047 4eb887 vmlinux >3285797 568506 1304616 5158919 4eb807 vmlinux.patched > >I was unable to measure a stable difference in the number of cpu cycles >spent in blockdev_direct_IO() when pushing aio+dio 256K reads at >~340MB/s. > >So the resulting intent of the patch isn't a performance gain but to >avoid exposing ourselves to the risk of finding another field like >.map_bh.b_state where we rely on zeroing but don't enforce it in the >code. > >Signed-off-by: Zach Brown <zach.brown@oracle.com> >Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> >--- > fs/direct-io.c | 18 +----------------- > 1 files changed, 1 insertions(+), 17 deletions(-) > >diff --git a/fs/direct-io.c b/fs/direct-io.c >index 6874785..901dc55 100644 >--- a/fs/direct-io.c >+++ b/fs/direct-io.c >@@ -958,36 +958,22 @@ direct_io_worker(int rw, struct kiocb *iocb, struct inode *inode, > ssize_t ret2; > size_t bytes; > >- dio->bio = NULL; > dio->inode = inode; > dio->rw = rw; > dio->blkbits = blkbits; > dio->blkfactor = inode->i_blkbits - blkbits; >- dio->start_zero_done = 0; >- dio->size = 0; > dio->block_in_file = offset >> blkbits; >- dio->blocks_available = 0; >- dio->cur_page = NULL; > >- dio->boundary = 0; >- dio->reap_counter = 0; > dio->get_block = get_block; > dio->end_io = end_io; >- dio->map_bh.b_private = NULL; >- dio->map_bh.b_state = 0; > dio->final_block_in_bio = -1; > dio->next_block_for_io = -1; > >- dio->page_errors = 0; >- dio->io_error = 0; >- dio->result = 0; > dio->iocb = iocb; > dio->i_size = i_size_read(inode); > > spin_lock_init(&dio->bio_lock); > dio->refcount = 1; >- dio->bio_list = NULL; >- dio->waiter = NULL; > > /* > * In case of non-aligned buffers, we may need 2 more >@@ -995,8 +981,6 @@ direct_io_worker(int rw, struct kiocb *iocb, struct inode *inode, > */ > if (unlikely(dio->blkfactor)) > dio->pages_in_io = 2; >- else >- dio->pages_in_io = 0; > > for (seg = 0; seg < nr_segs; seg++) { > user_addr = (unsigned long)iov[seg].iov_base; >@@ -1184,7 +1168,7 @@ __blockdev_direct_IO(int rw, struct kiocb *iocb, struct inode *inode, > } > } > >- dio = kmalloc(sizeof(*dio), GFP_KERNEL); >+ dio = kzalloc(sizeof(*dio), GFP_KERNEL); > retval = -ENOMEM; > if (!dio) > goto out; >-- >1.5.5.1 >
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
Attachments on
bug 461082
: 315715 |
315718