Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S938503AbXFHHma (ORCPT ); Fri, 8 Jun 2007 03:42:30 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S967787AbXFHHYc (ORCPT ); Fri, 8 Jun 2007 03:24:32 -0400 Received: from 216-99-217-87.dsl.aracnet.com ([216.99.217.87]:55206 "EHLO sous-sol.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S938334AbXFHHYb (ORCPT ); Fri, 8 Jun 2007 03:24:31 -0400 Message-Id: <20070608072219.380820000@sous-sol.org> References: <20070608072127.352723000@sous-sol.org> User-Agent: quilt/0.46-1 Date: Fri, 08 Jun 2007 00:22:00 -0700 From: Chris Wright To: linux-kernel@vger.kernel.org, stable@kernel.org, torvalds@linux-foundation.org Cc: Justin Forbes , Zwane Mwaikambo , "Theodore Ts'o" , Randy Dunlap , Dave Jones , Chuck Wolber , Chris Wedgwood , Michael Krufky , Chuck Ebbert , Domenico Andreoli , akpm@linux-foundation.org, alan@lxorguk.ukuu.org.uk, Andi Kleen , Arnaldo Carvalho de Melo , Greg Kroah-Hartman Subject: [patch 33/54] x86: fix oprofile double free Content-Disposition: inline; filename=x86-fix-oprofile-double-free.patch Sender: linux-kernel-owner@vger.kernel.org X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2190 Lines: 60 -stable review patch. If anyone has any objections, please let us know. --------------------- From: Chris Wright Chuck reports that the recent fix from Andi to oprofile 6c977aad03a18019015035958c65b6729cd0574c introduces a double free. Each cpu's cpu_msrs is setup to point to cpu 0's, which causes free_msrs to free cpu 0's pointers for_each_possible_cpu. Rather than copy the pointers, do a deep copy instead. [acme@redhat.com: allocate_msrs() was using for_each_online_cpu()] Signed-off-by: Chris Wright Cc: Andi Kleen Cc: Alan Cox Cc: Dave Jones Cc: Chuck Ebbert Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Andrew Morton Signed-off-by: Greg Kroah-Hartman --- arch/i386/oprofile/nmi_int.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) --- linux-2.6.21.4.orig/arch/i386/oprofile/nmi_int.c +++ linux-2.6.21.4/arch/i386/oprofile/nmi_int.c @@ -154,7 +154,7 @@ static int allocate_msrs(void) size_t counters_size = sizeof(struct op_msr) * model->num_counters; int i; - for_each_online_cpu(i) { + for_each_possible_cpu(i) { cpu_msrs[i].counters = kmalloc(counters_size, GFP_KERNEL); if (!cpu_msrs[i].counters) { success = 0; @@ -211,8 +211,14 @@ static int nmi_setup(void) /* Assume saved/restored counters are the same on all CPUs */ model->fill_in_addresses(&cpu_msrs[0]); for_each_possible_cpu (cpu) { - if (cpu != 0) - cpu_msrs[cpu] = cpu_msrs[0]; + if (cpu != 0) { + memcpy(cpu_msrs[cpu].counters, cpu_msrs[0].counters, + sizeof(struct op_msr) * model->num_counters); + + memcpy(cpu_msrs[cpu].controls, cpu_msrs[0].controls, + sizeof(struct op_msr) * model->num_controls); + } + } on_each_cpu(nmi_save_registers, NULL, 0, 1); on_each_cpu(nmi_cpu_setup, NULL, 0, 1); -- - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/