[PATCH] mtd: mtd_torturetest can cause stack overflows

[Ezequiel Garcia]

On Mon, Feb 4, 2013 at 6:29 PM, Al Cooper <alcooperx at gmail.com> wrote:
> mtd_torturetest uses the module parm "ebcnt" to control the size of a
> stack based array of int's. When "ebcnt" is large, Ex: 1000, it
> causes stack overflows on systems with small kernel stacks. The fix
> is to move the array from the stack to kmalloc memory.
>
> Signed-off-by: Al Cooper <alcooperx at gmail.com>
> ---
>  drivers/mtd/tests/mtd_torturetest.c |   10 +++++++++-
>  1 files changed, 9 insertions(+), 1 deletions(-)
>
> diff --git a/drivers/mtd/tests/mtd_torturetest.c b/drivers/mtd/tests/mtd_torturetest.c
> index c4cde1e..a777cc8 100644
> --- a/drivers/mtd/tests/mtd_torturetest.c
> +++ b/drivers/mtd/tests/mtd_torturetest.c
> @@ -208,7 +208,7 @@ static inline int write_pattern(int ebnum, void *buf)
>  static int __init tort_init(void)
>  {
>         int err = 0, i, infinite = !cycles_count;
> -       int bad_ebs[ebcnt];
> +       int *bad_ebs;
>
>         printk(KERN_INFO "\n");
>         printk(KERN_INFO "=================================================\n");
> @@ -273,6 +273,12 @@ static int __init tort_init(void)
>                 goto out_patt_FF;
>         }
>
> +       bad_ebs = kmalloc(sizeof(*bad_ebs) * ebcnt, GFP_KERNEL);
> +       if (!bad_ebs) {
> +               pr_err("error: cannot allocate memory\n");

You don't want to print this error. See:

http://www.spinics.net/lists/newbies/msg48792.html
http://archive.linuxvirtualserver.org/html/lvs-devel/2011-08/msg00001.html


-- 
    Ezequiel