Question

I working on some code in the linux kernel (2.4) and for some reason kmalloc returns the same address (I believe it only happens after the middle of the test). I checked that no calls to kfree were made between the calls to kmalloc (i.e memory is still in use).

maybe I’m out of memory ? (kmalloc didn’t return NULL…)

any ideas on how such a thing can happen ?

thanks in advance for the help!

code:

typedef struct
{
    char* buffer;
    int read_count;
    int write_count;
    struct semaphore read_sm;
    struct semaphore write_sm;
    int reader_ready;
    int writer_ready;
    int createTimeStamp;
} data_buffer_t ;

typedef struct vsf_t vsf_t;

struct vsf_t
{
    int minor;
    int type;
    int open_count;
    int waiting_pid;
    data_buffer_t* data;
    list_t proc_list;
    vsf_t* otherSide_vsf;
    int real_create_time_stamp;
};

int create_vsf(struct inode *inode, struct file *filp, struct vsf_command_parameters* parms)
{
...
    buff_data = allocate_buffer();
    if (buff_data == NULL)
    {
        kfree(this_vsfRead);
        kfree(this_vsfWrite);
        return -ENOMEM;
    }
...
}

data_buffer_t* allocate_buffer()
{
...
    data_buffer_t* this_buff = (data_buffer_t*)kmalloc(sizeof(data_buffer_t), GFP_KERNEL);
    if (this_buff == NULL)
    {
        printk( KERN_WARNING "failure at allocating memory\n" );
        return NULL;
    }
...
return this_buff;
}

*I print after every kmalloc and kfree,I’m absolutely sure that no kfree is called between kmalloc’s (that return the same adress)

Answer 1

I don’t know what kmalloc’s data structures look like but you could imagine this happening if a previous double free caused a cycle in a linked list of buffers. Further frees could still chain on additional distinct buffers (able to be reallocated) but once those were exhausted that last buffer would be returned indefinitely.