Skip to contentSkip to conversation

fix for double free in efi.c

PATCH New Takanori Kawano 1 participant 1 message Mar 26, 2002

lore
Share & tools
lore
#0 lore raw

PATCH 1/1 fix for double free in efi.c

The following is a fix for a double free bug in fs/partitions/efi.c.

efi.c.fixed renamed from efi.c +4 -2
@@ -546,8 +547,8 @@
 
 		*gpt = pgpt;
 		*ptes = pptes;
-		if (agpt)  kfree(agpt);
-		if (aptes) kfree(aptes);
+		if (agpt)   { kfree(agpt); agpt=NULL; }
+		if (aptes)  { kfree(aptes); aptes=NULL; }
 	} /* if primary is valid */
 	else {
 		/* Primary GPT is bad, check the Alternate GPT */
@@ -595,6 +596,8 @@
         if (agpt) {kfree(agpt); agpt = NULL;}
         if (pptes) {kfree(pptes); pptes = NULL;}
         if (aptes) {kfree(aptes); aptes = NULL;}
+        *gpt = NULL;
+        *ptes = NULL;
 	return 0;
 }
 

This patch is against redhat 2.4.9 kernel and has already been reported to redhat Bugzilla.

I suppose why such a serious bug has remained for a long time is that the current debug code in slab.c fails to detect double free in case the object holded by cpucaches is doubly freed.
I think the current debug code should be improved to detect this case.

---
Takanori Kawano
Hitachi Ltd,
Internet Systems Platform Division
[email protected]