[PATCH] oprofile per-cpu buffer overrun

From: Philippe Elie <phil.el@wanadoo.fr>

In a ring buffer controlled by a read and write positions we can't use
buffer_size but only buffer_size - 1 entry, the last free entry act as a
guard to avoid write pos overrun.  This bug was hidden because the writer,
oprofile_add_sample(), request one more entry than really needed.

diff --git a/drivers/oprofile/cpu_buffer.c b/drivers/oprofile/cpu_buffer.c
index 1a57df385996dd50027296615316462a5496a915..23979d38dde761a048ab52e38dcd5e628b94aa7e 100644 (file)
--- a/drivers/oprofile/cpu_buffer.c
+++ b/drivers/oprofile/cpu_buffer.c
@@ -86,9 +86,9 @@ static unsigned long nr_available_slots(struct oprofile_cpu_buffer const * b)
        unsigned long tail = b->tail_pos;
 
        if (tail > head)
-               return tail - head;
+               return (tail - head) - 1;
 
-       return tail + (b->buffer_size - head);
+       return tail + (b->buffer_size - head) - 1;
 }