Commit 2c53d910 authored by Aravind Srinivasan's avatar Aravind Srinivasan Committed by Linus Torvalds

relay: fix for possible loss/corruption of produced subbufs

Fix possible loss/corruption of produced subbufs in

When buf->subbufs_produced wraps around after UINT_MAX and
buf->subbufs_consumed is still < UINT_MAX, the condition

	if (buf->subbufs_consumed > buf->subbufs_produced)

will be true even for certain valid values of subbufs_consumed.  This may
lead to loss or corruption of produced subbufs.
Signed-off-by: 's avatarAravind Srinivasan <>
Cc: Tom Zanussi <>
Cc: Tom Zanussi <>
Signed-off-by: 's avatarAndrew Morton <>
Signed-off-by: 's avatarLinus Torvalds <>
parent edb79a21
......@@ -797,13 +797,15 @@ void relay_subbufs_consumed(struct rchan *chan,
if (!chan)
if (cpu >= NR_CPUS || !chan->buf[cpu])
if (cpu >= NR_CPUS || !chan->buf[cpu] ||
subbufs_consumed > chan->n_subbufs)
buf = chan->buf[cpu];
buf->subbufs_consumed += subbufs_consumed;
if (buf->subbufs_consumed > buf->subbufs_produced)
if (subbufs_consumed > buf->subbufs_produced - buf->subbufs_consumed)
buf->subbufs_consumed = buf->subbufs_produced;
buf->subbufs_consumed += subbufs_consumed;
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment