Bug: access to already released memory

Bug: access to already released memory

[Marek Skuczynski]

[-- Attachment #1: Type: text/plain, Size: 123 bytes --]

Hello,
   I have found two places where access to already released memory happens,
   attaching patches.

Regards,
  Marek

[-- Attachment #2: 0001-sh-Fix-access-to-released-memory-in-dwarf_unwinder_c.patch --]
[-- Type: text/x-patch, Size: 1273 bytes --]

From 1d0be80204871527e1e7757f4a009ce6f9ba0d73 Mon Sep 17 00:00:00 2001
From: Marek Skuczynski <mareksk7@gmail.com>
Date: Sat, 30 Jan 2010 22:27:41 +0100
Subject: [PATCH 1/2] sh: Fix access to released memory in dwarf_unwinder_cleanup()

Signed-off-by: Marek Skuczynski <mareksk7@gmail.com>
---
 arch/sh/kernel/dwarf.c |    8 ++++----
 1 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/arch/sh/kernel/dwarf.c b/arch/sh/kernel/dwarf.c
index 3576b70..88d28ec 100644
--- a/arch/sh/kernel/dwarf.c
+++ b/arch/sh/kernel/dwarf.c
@@ -892,18 +892,18 @@ static struct unwinder dwarf_unwinder = {
 
 static void dwarf_unwinder_cleanup(void)
 {
-	struct dwarf_cie *cie;
-	struct dwarf_fde *fde;
+	struct dwarf_cie *cie, *cie_tmp;
+	struct dwarf_fde *fde, *fde_tmp;
 
 	/*
 	 * Deallocate all the memory allocated for the DWARF unwinder.
 	 * Traverse all the FDE/CIE lists and remove and free all the
 	 * memory associated with those data structures.
 	 */
-	list_for_each_entry(cie, &dwarf_cie_list, link)
+	list_for_each_entry_safe(cie, cie_tmp, &dwarf_cie_list, link)
 		kfree(cie);
 
-	list_for_each_entry(fde, &dwarf_fde_list, link)
+	list_for_each_entry_safe(fde, fde_tmp, &dwarf_fde_list, link)
 		kfree(fde);
 
 	kmem_cache_destroy(dwarf_reg_cachep);
-- 
1.6.4.2


[-- Attachment #3: 0002-sh-Fix-access-to-released-memory-in-clk_debugfs_regi.patch --]
[-- Type: text/x-patch, Size: 1118 bytes --]

From d24a9cf204199f1bfb9215f5841192a1833f5fd7 Mon Sep 17 00:00:00 2001
From: Marek Skuczynski <mareksk7@gmail.com>
Date: Sat, 30 Jan 2010 22:29:32 +0100
Subject: [PATCH 2/2] sh: Fix access to released memory in clk_debugfs_register_one()

Signed-off-by: Marek Skuczynski <mareksk7@gmail.com>
---
 arch/sh/kernel/cpu/clock.c |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/sh/kernel/cpu/clock.c b/arch/sh/kernel/cpu/clock.c
index f3a46be..83da5de 100644
--- a/arch/sh/kernel/cpu/clock.c
+++ b/arch/sh/kernel/cpu/clock.c
@@ -598,7 +598,7 @@ static struct dentry *clk_debugfs_root;
 static int clk_debugfs_register_one(struct clk *c)
 {
 	int err;
-	struct dentry *d, *child;
+	struct dentry *d, *child, *child_tmp;
 	struct clk *pa = c->parent;
 	char s[255];
 	char *p = s;
@@ -630,7 +630,7 @@ static int clk_debugfs_register_one(struct clk *c)
 
 err_out:
 	d = c->dentry;
-	list_for_each_entry(child, &d->d_subdirs, d_u.d_child)
+	list_for_each_entry_safe(child, child_tmp, &d->d_subdirs, d_u.d_child)
 		debugfs_remove(child);
 	debugfs_remove(c->dentry);
 	return err;
-- 
1.6.4.2

Re: Bug: access to already released memory

[Paul Mundt]

On Sat, Jan 30, 2010 at 10:56:30PM +0100, Marek Skuczynski wrote:
>    I have found two places where access to already released memory happens,
>    attaching patches.
> 
I'll apply them for 2.6.33, thanks.

> Subject: [PATCH 2/2] sh: Fix access to released memory in clk_debugfs_register_one()
> 
> Signed-off-by: Marek Skuczynski <mareksk7@gmail.com>
> ---
>  arch/sh/kernel/cpu/clock.c |    4 ++--
>  1 files changed, 2 insertions(+), 2 deletions(-)
> 
Note that this code was copied from omap, so you may want to send them a
patch for arch/arm/plat-omap/clock.c, too.

Re: Bug: access to already released memory

[Matt Fleming]

On Sat, 30 Jan 2010 22:56:30 +0100, Marek Skuczynski <mareksk7@gmail.com> wrote:
> Hello,
>    I have found two places where access to already released memory happens,
>    attaching patches.
> 
> Regards,
>   Marek
> From 1d0be80204871527e1e7757f4a009ce6f9ba0d73 Mon Sep 17 00:00:00 2001
> From: Marek Skuczynski <mareksk7@gmail.com>
> Date: Sat, 30 Jan 2010 22:27:41 +0100
> Subject: [PATCH 1/2] sh: Fix access to released memory in dwarf_unwinder_cleanup()
> 
> Signed-off-by: Marek Skuczynski <mareksk7@gmail.com>
> ---
>  arch/sh/kernel/dwarf.c |    8 ++++----
>  1 files changed, 4 insertions(+), 4 deletions(-)
> 
> diff --git a/arch/sh/kernel/dwarf.c b/arch/sh/kernel/dwarf.c
> index 3576b70..88d28ec 100644
> --- a/arch/sh/kernel/dwarf.c
> +++ b/arch/sh/kernel/dwarf.c
> @@ -892,18 +892,18 @@ static struct unwinder dwarf_unwinder = {
>  
>  static void dwarf_unwinder_cleanup(void)
>  {
> -	struct dwarf_cie *cie;
> -	struct dwarf_fde *fde;
> +	struct dwarf_cie *cie, *cie_tmp;
> +	struct dwarf_fde *fde, *fde_tmp;
>  
>  	/*
>  	 * Deallocate all the memory allocated for the DWARF unwinder.
>  	 * Traverse all the FDE/CIE lists and remove and free all the
>  	 * memory associated with those data structures.
>  	 */
> -	list_for_each_entry(cie, &dwarf_cie_list, link)
> +	list_for_each_entry_safe(cie, cie_tmp, &dwarf_cie_list, link)
>  		kfree(cie);
>  
> -	list_for_each_entry(fde, &dwarf_fde_list, link)
> +	list_for_each_entry_safe(fde, fde_tmp, &dwarf_fde_list, link)
>  		kfree(fde);
>  
>  	kmem_cache_destroy(dwarf_reg_cachep);
> -- 
> 1.6.4.2
> 

Good catch.

Acked-by: Matt Fleming <matt@console-pimps.org>