* Bug: access to already released memory
@ 2010-01-30 21:56 Marek Skuczynski
2010-01-31 3:55 ` Paul Mundt
2010-01-31 11:55 ` Matt Fleming
0 siblings, 2 replies; 6+ messages in thread
From: Marek Skuczynski @ 2010-01-30 21:56 UTC (permalink / raw)
To: linux-sh
[-- Attachment #1: Type: text/plain, Size: 123 bytes --]
Hello,
I have found two places where access to already released memory happens,
attaching patches.
Regards,
Marek
[-- Attachment #2: 0001-sh-Fix-access-to-released-memory-in-dwarf_unwinder_c.patch --]
[-- Type: text/x-patch, Size: 1273 bytes --]
From 1d0be80204871527e1e7757f4a009ce6f9ba0d73 Mon Sep 17 00:00:00 2001
From: Marek Skuczynski <mareksk7@gmail.com>
Date: Sat, 30 Jan 2010 22:27:41 +0100
Subject: [PATCH 1/2] sh: Fix access to released memory in dwarf_unwinder_cleanup()
Signed-off-by: Marek Skuczynski <mareksk7@gmail.com>
---
arch/sh/kernel/dwarf.c | 8 ++++----
1 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/arch/sh/kernel/dwarf.c b/arch/sh/kernel/dwarf.c
index 3576b70..88d28ec 100644
--- a/arch/sh/kernel/dwarf.c
+++ b/arch/sh/kernel/dwarf.c
@@ -892,18 +892,18 @@ static struct unwinder dwarf_unwinder = {
static void dwarf_unwinder_cleanup(void)
{
- struct dwarf_cie *cie;
- struct dwarf_fde *fde;
+ struct dwarf_cie *cie, *cie_tmp;
+ struct dwarf_fde *fde, *fde_tmp;
/*
* Deallocate all the memory allocated for the DWARF unwinder.
* Traverse all the FDE/CIE lists and remove and free all the
* memory associated with those data structures.
*/
- list_for_each_entry(cie, &dwarf_cie_list, link)
+ list_for_each_entry_safe(cie, cie_tmp, &dwarf_cie_list, link)
kfree(cie);
- list_for_each_entry(fde, &dwarf_fde_list, link)
+ list_for_each_entry_safe(fde, fde_tmp, &dwarf_fde_list, link)
kfree(fde);
kmem_cache_destroy(dwarf_reg_cachep);
--
1.6.4.2
[-- Attachment #3: 0002-sh-Fix-access-to-released-memory-in-clk_debugfs_regi.patch --]
[-- Type: text/x-patch, Size: 1118 bytes --]
From d24a9cf204199f1bfb9215f5841192a1833f5fd7 Mon Sep 17 00:00:00 2001
From: Marek Skuczynski <mareksk7@gmail.com>
Date: Sat, 30 Jan 2010 22:29:32 +0100
Subject: [PATCH 2/2] sh: Fix access to released memory in clk_debugfs_register_one()
Signed-off-by: Marek Skuczynski <mareksk7@gmail.com>
---
arch/sh/kernel/cpu/clock.c | 4 ++--
1 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/sh/kernel/cpu/clock.c b/arch/sh/kernel/cpu/clock.c
index f3a46be..83da5de 100644
--- a/arch/sh/kernel/cpu/clock.c
+++ b/arch/sh/kernel/cpu/clock.c
@@ -598,7 +598,7 @@ static struct dentry *clk_debugfs_root;
static int clk_debugfs_register_one(struct clk *c)
{
int err;
- struct dentry *d, *child;
+ struct dentry *d, *child, *child_tmp;
struct clk *pa = c->parent;
char s[255];
char *p = s;
@@ -630,7 +630,7 @@ static int clk_debugfs_register_one(struct clk *c)
err_out:
d = c->dentry;
- list_for_each_entry(child, &d->d_subdirs, d_u.d_child)
+ list_for_each_entry_safe(child, child_tmp, &d->d_subdirs, d_u.d_child)
debugfs_remove(child);
debugfs_remove(c->dentry);
return err;
--
1.6.4.2
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: Bug: access to already released memory
2010-01-30 21:56 Bug: access to already released memory Marek Skuczynski
@ 2010-01-31 3:55 ` Paul Mundt
2010-01-31 10:00 ` Marek Skuczynski
2010-01-31 11:55 ` Matt Fleming
1 sibling, 1 reply; 6+ messages in thread
From: Paul Mundt @ 2010-01-31 3:55 UTC (permalink / raw)
To: linux-sh
On Sat, Jan 30, 2010 at 10:56:30PM +0100, Marek Skuczynski wrote:
> I have found two places where access to already released memory happens,
> attaching patches.
>
I'll apply them for 2.6.33, thanks.
> Subject: [PATCH 2/2] sh: Fix access to released memory in clk_debugfs_register_one()
>
> Signed-off-by: Marek Skuczynski <mareksk7@gmail.com>
> ---
> arch/sh/kernel/cpu/clock.c | 4 ++--
> 1 files changed, 2 insertions(+), 2 deletions(-)
>
Note that this code was copied from omap, so you may want to send them a
patch for arch/arm/plat-omap/clock.c, too.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Bug: access to already released memory
2010-01-31 3:55 ` Paul Mundt
@ 2010-01-31 10:00 ` Marek Skuczynski
2010-02-01 21:27 ` Paul Walmsley
0 siblings, 1 reply; 6+ messages in thread
From: Marek Skuczynski @ 2010-01-31 10:00 UTC (permalink / raw)
To: linux-omap; +Cc: Paul Mundt
[-- Attachment #1: Type: text/plain, Size: 887 bytes --]
Hello,
I have found an access to already released memory in
clk_debugfs_register_one() function,
attaching a patch. The included patch was prepared for Linux 2.6 repository.
Regards,
Marek
On Sun, Jan 31, 2010 at 4:55 AM, Paul Mundt <lethal@linux-sh.org> wrote:
> On Sat, Jan 30, 2010 at 10:56:30PM +0100, Marek Skuczynski wrote:
>> I have found two places where access to already released memory happens,
>> attaching patches.
>>
> I'll apply them for 2.6.33, thanks.
>
>> Subject: [PATCH 2/2] sh: Fix access to released memory in clk_debugfs_register_one()
>>
>> Signed-off-by: Marek Skuczynski <mareksk7@gmail.com>
>> ---
>> arch/sh/kernel/cpu/clock.c | 4 ++--
>> 1 files changed, 2 insertions(+), 2 deletions(-)
>>
> Note that this code was copied from omap, so you may want to send them a
> patch for arch/arm/plat-omap/clock.c, too.
>
[-- Attachment #2: 0001-arm-omap-Fix-access-to-already-released-memory-in-cl.patch --]
[-- Type: text/x-patch, Size: 1124 bytes --]
From a1d2a9cf952a119049989bea6b453b3b09c98b4b Mon Sep 17 00:00:00 2001
From: Marek Skuczynski <mareksk7@gmail.com>
Date: Sun, 31 Jan 2010 10:35:15 +0100
Subject: [PATCH] arm/omap: Fix access to already released memory in clk_debugfs_register_one()
Signed-off-by: Marek Skuczynski <mareksk7@gmail.com>
---
arch/arm/plat-omap/clock.c | 4 ++--
1 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/arm/plat-omap/clock.c b/arch/arm/plat-omap/clock.c
index d9f8c84..4becbdd 100644
--- a/arch/arm/plat-omap/clock.c
+++ b/arch/arm/plat-omap/clock.c
@@ -391,7 +391,7 @@ static struct dentry *clk_debugfs_root;
static int clk_debugfs_register_one(struct clk *c)
{
int err;
- struct dentry *d, *child;
+ struct dentry *d, *child, *child_tmp;
struct clk *pa = c->parent;
char s[255];
char *p = s;
@@ -423,7 +423,7 @@ static int clk_debugfs_register_one(struct clk *c)
err_out:
d = c->dent;
- list_for_each_entry(child, &d->d_subdirs, d_u.d_child)
+ list_for_each_entry_safe(child, child_tmp, &d->d_subdirs, d_u.d_child)
debugfs_remove(child);
debugfs_remove(c->dent);
return err;
--
1.6.4.2
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: Bug: access to already released memory
2010-01-30 21:56 Bug: access to already released memory Marek Skuczynski
2010-01-31 3:55 ` Paul Mundt
@ 2010-01-31 11:55 ` Matt Fleming
1 sibling, 0 replies; 6+ messages in thread
From: Matt Fleming @ 2010-01-31 11:55 UTC (permalink / raw)
To: linux-sh
On Sat, 30 Jan 2010 22:56:30 +0100, Marek Skuczynski <mareksk7@gmail.com> wrote:
> Hello,
> I have found two places where access to already released memory happens,
> attaching patches.
>
> Regards,
> Marek
> From 1d0be80204871527e1e7757f4a009ce6f9ba0d73 Mon Sep 17 00:00:00 2001
> From: Marek Skuczynski <mareksk7@gmail.com>
> Date: Sat, 30 Jan 2010 22:27:41 +0100
> Subject: [PATCH 1/2] sh: Fix access to released memory in dwarf_unwinder_cleanup()
>
> Signed-off-by: Marek Skuczynski <mareksk7@gmail.com>
> ---
> arch/sh/kernel/dwarf.c | 8 ++++----
> 1 files changed, 4 insertions(+), 4 deletions(-)
>
> diff --git a/arch/sh/kernel/dwarf.c b/arch/sh/kernel/dwarf.c
> index 3576b70..88d28ec 100644
> --- a/arch/sh/kernel/dwarf.c
> +++ b/arch/sh/kernel/dwarf.c
> @@ -892,18 +892,18 @@ static struct unwinder dwarf_unwinder = {
>
> static void dwarf_unwinder_cleanup(void)
> {
> - struct dwarf_cie *cie;
> - struct dwarf_fde *fde;
> + struct dwarf_cie *cie, *cie_tmp;
> + struct dwarf_fde *fde, *fde_tmp;
>
> /*
> * Deallocate all the memory allocated for the DWARF unwinder.
> * Traverse all the FDE/CIE lists and remove and free all the
> * memory associated with those data structures.
> */
> - list_for_each_entry(cie, &dwarf_cie_list, link)
> + list_for_each_entry_safe(cie, cie_tmp, &dwarf_cie_list, link)
> kfree(cie);
>
> - list_for_each_entry(fde, &dwarf_fde_list, link)
> + list_for_each_entry_safe(fde, fde_tmp, &dwarf_fde_list, link)
> kfree(fde);
>
> kmem_cache_destroy(dwarf_reg_cachep);
> --
> 1.6.4.2
>
Good catch.
Acked-by: Matt Fleming <matt@console-pimps.org>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Bug: access to already released memory
2010-01-31 10:00 ` Marek Skuczynski
@ 2010-02-01 21:27 ` Paul Walmsley
2010-02-01 23:10 ` Tony Lindgren
0 siblings, 1 reply; 6+ messages in thread
From: Paul Walmsley @ 2010-02-01 21:27 UTC (permalink / raw)
To: Marek Skuczynski; +Cc: linux-omap, Paul Mundt
On Sun, 31 Jan 2010, Marek Skuczynski wrote:
> Hello,
> I have found an access to already released memory in
> clk_debugfs_register_one() function,
> attaching a patch. The included patch was prepared for Linux 2.6 repository.
>
Acked-by: Paul Walmsley <paul@pwsan.com>
Thanks Marek and Paul.
- Paul
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Bug: access to already released memory
2010-02-01 21:27 ` Paul Walmsley
@ 2010-02-01 23:10 ` Tony Lindgren
0 siblings, 0 replies; 6+ messages in thread
From: Tony Lindgren @ 2010-02-01 23:10 UTC (permalink / raw)
To: Paul Walmsley; +Cc: Marek Skuczynski, linux-omap, Paul Mundt
* Paul Walmsley <paul@pwsan.com> [100201 13:25]:
> On Sun, 31 Jan 2010, Marek Skuczynski wrote:
>
> > Hello,
> > I have found an access to already released memory in
> > clk_debugfs_register_one() function,
> > attaching a patch. The included patch was prepared for Linux 2.6 repository.
> >
>
> Acked-by: Paul Walmsley <paul@pwsan.com>
>
> Thanks Marek and Paul.
Adding to omap-fixes queue for 2.6.33.
Tony
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2010-02-01 23:09 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2010-01-30 21:56 Bug: access to already released memory Marek Skuczynski
2010-01-31 3:55 ` Paul Mundt
2010-01-31 10:00 ` Marek Skuczynski
2010-02-01 21:27 ` Paul Walmsley
2010-02-01 23:10 ` Tony Lindgren
2010-01-31 11:55 ` Matt Fleming
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.