Commit 788cf5b6 authored Dec 05, 2023 by Liu Shixin

mm/swap_slots: fix out-of-bounds access of percpu area

hulk inclusion
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I8LKYV



--------------------------------

Variable swp_type_slots is an array with type 'struct swap_slots_cache[]'.
So raw_cpu_ptr(&swp_type_slots) is correspoinding pointer of array. Its
type is 'struct swap_slots_cache[]' rather than 'struct swap_slots_cache'.
So the offset of raw_cpu_ptr(&swp_type_slots)[swap_type] is out-of-bounds.
Use raw_cpu_ptr(&swp_type_slots[swap_type]) to get the correct variable.

Fixes: 8e41c366 ("mm: swap_slots: add per-type slot cache")
Signed-off-by: Liu Shixin <liushixin2@huawei.com>

parent 500c38d3

mm/swap_slots.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -122,7 +122,7 @@ static inline struct swap_slots_cache *get_slots_cache(int swap_type)
		if (swap_type == SWAP_TYPE_ALL)
		return raw_cpu_ptr(&swp_slots);
		else
		return raw_cpu_ptr(&swp_type_slots)[swap_type];
		return raw_cpu_ptr(&swp_type_slots[swap_type]);
		}

		static inline struct swap_slots_cache *get_slots_cache_cpu(unsigned int cpu,