From mboxrd@z Thu Jan 1 00:00:00 1970 From: tytso@mit.edu Date: Wed, 23 Dec 2009 12:53:34 +0000 Subject: Re: [PATCH 2/2] fs/ext4: Eliminate double free Message-Id: <20091223125334.GE21594@thunk.org> List-Id: References: In-Reply-To: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: Julia Lawall Cc: Andreas Dilger , linux-ext4@vger.kernel.org, linux-kernel@vger.kernel.org, kernel-janitors@vger.kernel.org On Sun, Dec 20, 2009 at 06:07:10PM +0100, Julia Lawall wrote: > From: Julia Lawall > > b_entry_name and buffer are initially NULL, are initialized within a loop > to the result of calling kmalloc, and are freed at the bottom of this loop. > The loop contains gotos to cleanup, which also frees b_entry_name and > buffer. Some of these gotos are before the reinitializations of > b_entry_name and buffer. To maintain the invariant that b_entry_name and > buffer are NULL at the top of the loop, and thus acceptable arguments to > kfree, these variables are now set to NULL after the kfrees. > > This seems to be the simplest solution. A more complicated solution > would be to introduce more labels in the error handling code at the end of > the function. Thanks, added to the ext4 patch queue. - Ted From mboxrd@z Thu Jan 1 00:00:00 1970 From: tytso@mit.edu Subject: Re: [PATCH 2/2] fs/ext4: Eliminate double free Date: Wed, 23 Dec 2009 07:53:34 -0500 Message-ID: <20091223125334.GE21594@thunk.org> References: Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: Andreas Dilger , linux-ext4@vger.kernel.org, linux-kernel@vger.kernel.org, kernel-janitors@vger.kernel.org To: Julia Lawall Return-path: Content-Disposition: inline In-Reply-To: Sender: linux-kernel-owner@vger.kernel.org List-Id: linux-ext4.vger.kernel.org On Sun, Dec 20, 2009 at 06:07:10PM +0100, Julia Lawall wrote: > From: Julia Lawall > > b_entry_name and buffer are initially NULL, are initialized within a loop > to the result of calling kmalloc, and are freed at the bottom of this loop. > The loop contains gotos to cleanup, which also frees b_entry_name and > buffer. Some of these gotos are before the reinitializations of > b_entry_name and buffer. To maintain the invariant that b_entry_name and > buffer are NULL at the top of the loop, and thus acceptable arguments to > kfree, these variables are now set to NULL after the kfrees. > > This seems to be the simplest solution. A more complicated solution > would be to introduce more labels in the error handling code at the end of > the function. Thanks, added to the ext4 patch queue. - Ted