From mboxrd@z Thu Jan 1 00:00:00 1970 From: Alan Jenkins Date: Sat, 01 Nov 2008 16:09:16 +0000 Subject: udevd: fix termination of rule execution Message-Id: <490C7F2C.1030802@tuffmail.co.uk> List-Id: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: linux-hotplug@vger.kernel.org LAST_RULE was broken, and I broke TK_END by making it do the same. It used a "break" which exited the switch statement, but not the loop! =2953= Invalid read of size 4 =2953= at 0x4081EE: dump_token (udev-rules.c:859) =2953= by 0x40BADB: udev_rules_apply_to_event (udev-rules.c:1849) =2953= by 0x403F17: udev_event_execute_rules (udev-event.c:554) =2953= by 0x418626: main (test-udev.c:100) =2953= Address 0x55ab1f8 is 0 bytes after a block of size 80 alloc'd =2953= at 0x4C23082: realloc (vg_replace_malloc.c:429) =2953= by 0x40B13B: udev_rules_new (udev-rules.c:1670) =2953= by 0x418536: main (test-udev.c:84) ... Signed-off-by: Alan Jenkins diff --git a/udev/udev-rules.c b/udev/udev-rules.c index f6cc45b..77029f7 100644 --- a/udev/udev-rules.c +++ b/udev/udev-rules.c @@ -2319,7 +2319,7 @@ int udev_rules_apply_to_event(struct udev_rules *rules, struct udev_event *event continue; case TK_A_LAST_RULE: case TK_END: - break; + return 0; case TK_M_PARENTS_MAX: case TK_M_MAX: @@ -2334,9 +2334,8 @@ int udev_rules_apply_to_event(struct udev_rules *rules, struct udev_event *event /* fast-forward to next rule */ idx = rule->rule.next_rule; if (idx = 0) - break; + return 0; dbg(rules->udev, "forward to rule: %u\n", idx); cur = &rules->tokens[idx]; } - return 0; }