* [PATCH] modify_ldt: initialize scratch
@ 2014-01-20 20:15 Jiri Slaby
2014-01-20 21:39 ` Dave Jones
0 siblings, 1 reply; 2+ messages in thread
From: Jiri Slaby @ 2014-01-20 20:15 UTC (permalink / raw)
To: davej; +Cc: trinity, jirislaby
From: Jiri Slaby <jirislaby@gmail.com>
We store a pointer in the scratch area, but only conditionally. Hence
there can be an uninitialized value which causes problems in the
tear-down path:
*** Error in `trinity': double free or corruption (!prev):
0x0000000002484530 ***
======= Backtrace: =========
/lib64/libc.so.6(+0x740af)[0x7f2a66eb60af]
/lib64/libc.so.6(+0x798de)[0x7f2a66ebb8de]
/lib64/libc.so.6(+0x7a5e6)[0x7f2a66ebc5e6]
trinity[0x40abc8]
trinity[0x40dabc]
trinity[0x40338a]
trinity[0x40704c]
trinity[0x402c47]
/lib64/libc.so.6(__libc_start_main+0xf5)[0x7f2a66e63b15]
trinity[0x402f13]
---
syscalls/modify_ldt.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/syscalls/modify_ldt.c b/syscalls/modify_ldt.c
index de9cbbe..c0cac1a 100644
--- a/syscalls/modify_ldt.c
+++ b/syscalls/modify_ldt.c
@@ -18,6 +18,7 @@ static void sanitise_modify_ldt(int childno)
void *ldt;
//struct user_desc *desc;
+ shm->scratch[childno] = 0;
switch (shm->a1[childno]) {
case 0:
/* read the ldt into the memory pointed to by ptr.
--
1.8.5.2
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] modify_ldt: initialize scratch
2014-01-20 20:15 [PATCH] modify_ldt: initialize scratch Jiri Slaby
@ 2014-01-20 21:39 ` Dave Jones
0 siblings, 0 replies; 2+ messages in thread
From: Dave Jones @ 2014-01-20 21:39 UTC (permalink / raw)
To: Jiri Slaby; +Cc: trinity, jirislaby
On Mon, Jan 20, 2014 at 09:15:35PM +0100, Jiri Slaby wrote:
> From: Jiri Slaby <jirislaby@gmail.com>
>
> We store a pointer in the scratch area, but only conditionally. Hence
> there can be an uninitialized value which causes problems in the
> tear-down path:
duh, good catch. Applied.
Dave
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2014-01-20 21:39 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2014-01-20 20:15 [PATCH] modify_ldt: initialize scratch Jiri Slaby
2014-01-20 21:39 ` Dave Jones
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).