jthornber/linux-2.6 — pull request #17 by satoru-takeuchi (2014-08-24 02:39:43+00:00)
Title: From: Satoru Takeuchi <satoru.takeuchi@gmail.com>

If users set a very large value to nr_rambuf_pool argument, kernel would hit
BUG() in the error route of init_rambuf_pool().

drivers/md/dm-writeboost-metadata.c:
===============================================================================
...
static int init_rambuf_pool(struct wb_device *wb)
{
int r = 0;
size_t i;

wb->rambuf_pool = kmalloc(sizeof(struct rambuffer) * wb->nr_rambuf_pool,
GFP_KERNEL);
if (!wb->rambuf_pool) # It is true here.
return -ENOMEM;

wb->rambuf_cachep = kmem_cache_create("dmwb_rambuf",
1 << (wb->segment_size_order + SECTOR_SHIFT),
1 << (wb->segment_size_order + SECTOR_SHIFT),
SLAB_RED_ZONE, NULL);
if (!wb->rambuf_cachep) {
r = -ENOMEM; # Enter this route or ....
goto bad_cachep;
}

for (i = 0; i < wb->nr_rambuf_pool; i++) {
size_t j;
struct rambuffer *rambuf = wb->rambuf_pool + i;

rambuf->data = kmem_cache_alloc(wb->rambuf_cachep, GFP_KERNEL);
if (!rambuf->data) {
... # ... enter this route.
goto bad_alloc_data;
}
check_buffer_alignment(rambuf->data);
}

return r;

bad_alloc_data:
kmem_cache_destroy(wb->rambuf_cachep);
bad_cachep:
kfree(wb->rambuf_pool);
BUG(); # Kernel panic happens here.
return r;
}
...
===============================================================================

Probably this BUG() was introduced erroneously and is safe to remove.

Signed-off-by: Satoru Takeuchi
Cc: Joe Thornber
Cc: Akira Hayakawa