From: Takanori Kawano <t-kawano@ebina.hitachi.co.jp>
To: linux-ia64@vger.kernel.org
Subject: [Linux-ia64] [PATCH]fix for double free in efi.c
Date: Tue, 26 Mar 2002 11:11:12 +0000 [thread overview]
Message-ID: <marc-linux-ia64-105590701905336@msgid-missing> (raw)
The following is a fix for a double free bug in fs/partitions/efi.c.
--- efi.c Fri Mar 1 16:59:19 2002
+++ efi.c.fixed Mon Mar 11 16:34:29 2002
@@ -546,8 +547,8 @@
*gpt = pgpt;
*ptes = pptes;
- if (agpt) kfree(agpt);
- if (aptes) kfree(aptes);
+ if (agpt) { kfree(agpt); agpt=NULL; }
+ if (aptes) { kfree(aptes); aptes=NULL; }
} /* if primary is valid */
else {
/* Primary GPT is bad, check the Alternate GPT */
@@ -595,6 +596,8 @@
if (agpt) {kfree(agpt); agpt = NULL;}
if (pptes) {kfree(pptes); pptes = NULL;}
if (aptes) {kfree(aptes); aptes = NULL;}
+ *gpt = NULL;
+ *ptes = NULL;
return 0;
}
This patch is against redhat 2.4.9 kernel and has already
been reported to redhat Bugzilla.
I suppose why such a serious bug has remained for a long time
is that the current debug code in slab.c fails to detect
double free in case the object holded by cpucaches is doubly
freed.
I think the current debug code should be improved to detect
this case.
---
Takanori Kawano
Hitachi Ltd,
Internet Systems Platform Division
t-kawano@ebina.hitachi.co.jp
reply other threads:[~2002-03-26 11:11 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=marc-linux-ia64-105590701905336@msgid-missing \
--to=t-kawano@ebina.hitachi.co.jp \
--cc=linux-ia64@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox