2002-03-26 11:56:45

by Takanori Kawano

Subject: [PATCH]fix for double free in efi.c

The following is a fix for a double free bug in fs/partitions/efi.c.

--- efi.c Fri Mar 1 16:59:19 2002
+++ efi.c.fixed Mon Mar 11 16:34:29 2002
@@ -546,8 +547,8 @@

*gpt = pgpt;
*ptes = pptes;
- if (agpt) kfree(agpt);
- if (aptes) kfree(aptes);
+ if (agpt) { kfree(agpt); agpt=NULL; }
+ if (aptes) { kfree(aptes); aptes=NULL; }
} /* if primary is valid */
else {
/* Primary GPT is bad, check the Alternate GPT */
@@ -595,6 +596,8 @@
if (agpt) {kfree(agpt); agpt = NULL;}
if (pptes) {kfree(pptes); pptes = NULL;}
if (aptes) {kfree(aptes); aptes = NULL;}
+ *gpt = NULL;
+ *ptes = NULL;
return 0;
}


This patch is against redhat 2.4.9 kernel and has already
been reported to redhat Bugzilla.

I suppose why such a serious bug has remained for a long time
is that the current debug code in slab.c fails to detect
double free in case the object holded by cpucaches is doubly
freed.
I think the current debug code should be improved to detect
this case.

---
Takanori Kawano
Hitachi Ltd,
Internet Systems Platform Division
[email protected]

2002-03-26 12:58:59

by Matt Domsch

Subject: RE: [PATCH]fix for double free in efi.c

> The following is a fix for a double free bug in fs/partitions/efi.c.

Indeed, this was pointed out a couple weeks ago and since fixed in the IA-64
port. I'm readying a cleanup around EFI's use of GUIDs which affects
fs/partitions/efi.[ch] too and hope to have that ready to submit yet this
week.

Thanks,
Matt

--
Matt Domsch
Sr. Software Engineer
Dell Linux Solutions http://www.dell.com/linux
Linux on Dell mailing lists @ http://lists.us.dell.com
#1 US Linux Server provider for 2001! (IDC Mar 2002)