Skip to contentSkip to conversation

Fix memory leak in copy_thread

PATCH In review Andi Kleen 1 participant 2 messages Mar 9, 2003

lore
Share & tools
lore

Andi Kleen

author
#0 lore raw

PATCH 1/1 Fix memory leak in copy_thread

Discovered on x86-64 and now ported.

copy_thread could leak memory if you had a io bitmap and passed wrong arguments to the new clone flags.

-Andi

arch/i386/kernel/process.c +12 -4
@@ -281,6 +281,7 @@
 {
 	struct pt_regs * childregs;
 	struct task_struct *tsk;
+	int err;
 
 	childregs = ((struct pt_regs *) (THREAD_SIZE + (unsigned long) p->thread_info)) - 1;
 	struct_cpy(childregs, regs);

@@ -316,20 +317,27 @@
 		struct user_desc info;
 		int idx;
 
+		err = -EFAULT;
 		if (copy_from_user(&info, (void *)childregs->esi, sizeof(info)))
-			return -EFAULT;
+			goto out;
+		err = -EINVAL;
 		if (LDT_empty(&info))
-			return -EINVAL;
+			goto out;
 
 		idx = info.entry_number;
 		if (idx < GDT_ENTRY_TLS_MIN || idx > GDT_ENTRY_TLS_MAX)
-			return -EINVAL;
+			goto out;
 
 		desc = p->thread.tls_array + idx - GDT_ENTRY_TLS_MIN;
 		desc->a = LDT_entry_a(&info);
 		desc->b = LDT_entry_b(&info);
 	}
-	return 0;
+
+	err = 0;
+ out:
+	if (p->thread.ts_io_bitmap)
+		kfree(p->thread.ts_io_bitmap);
+	return err;
 }
 
 /*
author
#1 lore raw

Re: [PATCH] Fix memory leak in copy_thread - correction.

Quoted 4 lines · Andi Kleen

Discovered on x86-64 and now ported.

copy_thread could leak memory if you had a io bitmap and passed wrong arguments to the new clone flags.

[...]

Oops that was the wrong buggy version of the patch. Please ignore that and use this one

-Andi

arch/i386/kernel/process.c +12 -4
@@ -281,6 +281,7 @@
 {
 	struct pt_regs * childregs;
 	struct task_struct *tsk;
+	int err;
 
 	childregs = ((struct pt_regs *) (THREAD_SIZE + (unsigned long) p->thread_info)) - 1;
 	struct_cpy(childregs, regs);

@@ -316,20 +317,27 @@
 		struct user_desc info;
 		int idx;
 
+		err = -EFAULT;
 		if (copy_from_user(&info, (void *)childregs->esi, sizeof(info)))
-			return -EFAULT;
+			goto out;
+		err = -EINVAL;
 		if (LDT_empty(&info))
-			return -EINVAL;
+			goto out;
 
 		idx = info.entry_number;
 		if (idx < GDT_ENTRY_TLS_MIN || idx > GDT_ENTRY_TLS_MAX)
-			return -EINVAL;
+			goto out;
 
 		desc = p->thread.tls_array + idx - GDT_ENTRY_TLS_MIN;
 		desc->a = LDT_entry_a(&info);
 		desc->b = LDT_entry_b(&info);
 	}
-	return 0;
+
+	err = 0;
+ out:
+	if (!err && p->thread.ts_io_bitmap)
+		kfree(p->thread.ts_io_bitmap);
+	return err;
 }
 
 /*